p * 


Freedom of Information 

and 

Privacy Acts 

SUBJECT: DCS 3000 
FOLDER: DIVISION DOCUMENTS 
SECTION #37 



Federal Bureau of Investigation 


IG^Poi 


FEDERAL BUREAU OF INVESTIG 
FOIPA 

DELETED PAGE INFORMATION SHEET 


Serial Description ~ COVER SHEET 


Total Deleted Page(s) ~ 1 

Page 212 - b2, b6, b7A, b7C, b7E 



X 




Follow Up Flag: Read 

Flag Status: Flagged 



non-recorcT 


I I - please forward to the Unit. 

All, 


b6 

b7C 


In an effort to answer a FOIA request, I am requesting that all TICTU employees and contractors immediately do a word 
search of their e-mail system (active and archived records) for the term "DCS-3000" and "DCS 30 00" and '' DCS3000" 
(variations of the same term). If a document or e-mail is located print it and bring the hard copy tc] [for compilation. 

I need this accomplished ASAP. If there is a negative response - 1 need that also. 


DATE: 06-18-2007 

CLASSIFIED BY 65179DMH/K3R/LHF 


REAS Off: 1.4 (S) 

DECLASSIFY OH: 06-18-2032 



ALL IffFORHATIOH C0HTAIHED 
HERE Iff IS TJHCLA33IFIEB EXCEPT 
WHERE SHOOT OTHERWISE 




This is the only email. | [ contacted me by phone to give me the date of Wednesday afternoon, Sept 27, 2006 asfos 

a time. fo?c 

If Qu antico will n ot fund the circuit (we will try that first), then Birmingham division will need a circuit installed b 7 E 
ere to| |RA to pu sh pen reg ister data in real time to their DCS-3000 collection system. They will need 

real tim e data to seno over to th d l classified system when they go up on their FISURs, which is pending, 
f |is going to check with Quantico as for as the required bandwidth, 


| |c an you request from TICTU a circuit for | ~| RA ' S DCS-3000 for pen register data for the ! l system? 

| lean you get wittj ffor the requirements to push the pen register data to the| | Does| |ieed to put 

man RMS request? 1 1 — 1 1 


Technical Advisor - Birmingham Division 



Thanks for the information. 

I would also like to have a DCSP at the Knoxville and I ~l sites to assist. This will help the Tech squad with their 
limited personnel available. If you could give me dates I will see that it is scheduled. I have listed below the DCSP 
available for each site. 

b6 
lb7C 




Elsur Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 


Ooerational Technology Division (OTD) 
71 3| iDesk) 

71 3 |Fax) 

8321 pell) 


b2 

fob 


b7C 



I have passe d l and Knoxville tq_ 

support Also New Orleans will be upgrai 
checkout ! yn entioned tha t the system 
will upgrade. Please contact) 


|f or sites to have Raytheon provide the Security upgrade 
so Dy Kaytneon during a visit they haive scheduled for a system 
iere may be a version behind in baseline load as well which Raytheon 
lto coordinate the NO install if you want to have a DCSP present at that 


SJ 



hz 

fo7E 


0 JiLQKK £ 

Basically! I needs the order then they can give us the date we require. 

1 believe the data will co me across the DCS 3000. _ 

We have a connection to l ~l throuqh the DCS 3000 on the FISA side l I floorl 
I don't know how tough it will be to get it upstairs on the | { floor DCS 3000. 

So -I would actually contac l |down at Q uantico first. 

Let them know we have a pen register oraer to n I for a criminal intercept. 

Ask them to assist you in setting up the DCS 3000 for this. 


ure out how to get the order to them, 
to the TICTU website). - 


Keep me posted on the progress and let me know If there is anything else I can do to assist. 
Thank you, 

[ 



NON-RECORD 


While they are working on that I would contadT 


| o figi 
_ { according 


fo2 
lb 6 
b7C 
b7E 


We received a | 1 hardline for[ 

How will we collect the data for the line? 


]cR-3) on 9/27/06. 


Ib2 

b6 

lb7C 

b7E 


FBI-WFO 

Telecommunication Specialist 
IS-2 

202 \ ~1 


be 

b7C 


UNCLASSIFIED 

UNCLA S S I F I E D- 

IJMCI * eeicit^n 


SECRET 





The service you provided was instrumental in the successful rescue of the kidnap victim. Well done 

Hopefull j | service will only improve in case something like this happens again (should be when it happens 
again). 


Thanks for taking the late night and weekend calls. 



NON-RECORD 






exigent circumstance trap & traces on|_jrioneSi|^___| | | 
Division, and an emergency. Title III. I can't say enoug h about the successful u se of the DC530DTT 
data. We were able to watch th e calls a s they came irj ind then advise the IndJ 

where to center in on. Oncethel Ivehicle was in i 




y a case wnicn couia not nave oeen resoivea tms qui< 
knowledge, equipment, and experience. Thanks to everyone involved. 


1 1 ? r» i « r»i f «i« 1 f »1 1 1 '1 i 1 iTi 


e expertise of our tech 


Thanks, all.. Well done!! 


JDO) (FBI); THOMAS, MARCUS C. (OTP) (FBI) 


Ithis was the case you called me about. 


Michael P. Clifford, Jr. 
Section Chief 





1 


Electronic Surveillance Technology Section 


Opei 

(703) 

(703) 

(800 


o 


:hnology Division 
lOffice) 

Cell) 

Pager) 


CrfET be 

>n » b7c 


— Original Message— 


weanesaay, September 


]OTD) (FBI) 
■20, 2006 12:(1 


Subject: FW: Tech Victory 


SENS I TIVfcP U T UNCLA S SIF I ED 
NON-RECORD 


[OTD) (FBI);|_ 


be 

b7C 


be 

b7C 


IJaTD) (FBI)C 


□ (OTD) (FBI); CLIFFORD, 


The service you provided was instrumental in the successful rescue of the kidnap victim. Well done 

Hopefully } { service will only improve in case something like this happens again (should be when it happens 
again). 1 1 

Thanks for taking the late night and weekend calls. 


— Original Message— 


b6 

b7C 


Tech Victory 


JSI) (FBI) 

1, 2006 11:26 AM 

_ ^ Tqum 

Ibl) fl-BI) f 


□(IP) (FBI)£ 


□ (IP) (FBI)C 


□(SI) (CON) 


NON-RECORD 







|(OTD) (FBI) 


Subject: 


Wednesday. September 20 . 2006 1:37 PM 
' _J(OTD) (FBI) 


FW: Kidnapping 


.. .we done pretty good for a couple of Tech engineers. 


19, 2006 3:20 
|(OTD) (FBI) 


b6 

b7c 


[TO (FBI) 


NON-RECORD 


Wrapping 


b7C 

b7E 







Guys, 

Can we get him an fairty accurate number using the database? Thoughts and comments. 



NON-RECORD 


□ 

Can you give me the total number of deployed dcs-3000 systems? I only need to know what is currently fielded. 


!ET 





_^6 Rrr 


Can you give me the total number of deployed dcs-3000 systems? I only need to know what is currently fielded. 
Thanks, 

] 


Management & Program Analyst 
Office: 70 ^1 
Cell: Tda | 

Fax: 7031 


b2 

b6 

b7C 



mOLAQoin sa 


UNCLASSIFIED 


From: 

Sent: 

To: 

Subject: 


be 

b7C 


1 (OTD) (FBI) 

I 1 (OTD) (FBI) 

Tuesday September 19 2006 3:33 PM 
1 | (OTD) (FBI) 

1 Deployed systems 1 


JJMCLAGOirtCP 
NON-RECORD h6 

b7C 

□ 

Can you give me the total number of deployed dcs-3000 systems? I only need to know what is currently fielded. 



b2 

be 

b7C 


](OTD) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


Jpg 


PG) (FBI) 

.19,2006 3:20 PM 
J(OTD) (FBI) 


1 kidnaping 


-1. J [W/ 

JOTD) (FBI) 


SENS I T I V E BU T UNCLAS Stf 

NON-RECORD 


b2 

be 

b7C 

b7E 


iThanks for your help regarding the I Ithrouah the DC S 3000. Soon after I snnk e tn vnu I was ahle tn 

I . This info enabled them tc j | 

hey are now interviewing evSryOHH IU HUterminS 1 
ike this, it is a great comfort to know you are 

always there to help. Thanks again. We appreciafe your assistance. 




b7C 


From: 

Sent: 

To: 

Cc: 

Subject: 


-U NCkASS I W EP- 




(FBI) 


K OTD) (FBI) 

/ fipnfpmtj ar IQ 2006 ? fi? PM 

— 


IfOTDUCON 
JOTD) (FBI) 


S E NS I T I V E BUT UNCLASS I F I ED 
NON-RECORD fc6 


Attached is a quick slide for the DCS3000. Do you think a graphic would be better than listing all the application 
names? 



DCS3000.ppt (211 
KB) 


SENSIT I V E B U T U NC L ASSIF IED 


From: 

Sent: 

To: 

Cc: 


Subject: 


I (OTP) (FBI) 

E 


JOTD) (CON) 


Friday. September 15 2006 4:38 PM 

■ I 

I I TOTD) (FBI) 

d Intercept 


RE: Switch based Intercept Classes for FY 2007 


](OTD) (FB»[ 


] 


fob 

fc7C 


U NCLASS I F I ED - 

NON-RECORD 


I 1 

Overview/description of the CBT course is as follows: 

The Telecommunications Intercept and Collection Technology Unit is pleased to announce the release of a 
computer-based training course entitled, "Switch Based Intercpets using DCS 3000." This training focuses on an 
FBI software application used to conduct CALEA based intercepts. The course is designed for Tehnically-Trained 
Agents and covers the installation, configuration and use of the DCS 3000 suite of applications. The instructional 
material is provided on a CD and the entire course is designed to be completed in approximately four (4) hours. 

Since this courseware is now mandatory for students wanting to take enhanced classroom training provided by SBIT, we 
definitely need to meet to make sure we are all on the same page regarding us expanding our training. Currently, I provide 
the CBT as requested. Also, I'm not sure of all the logistics involved with having the CBT transferred over to the Virtual 
Academy and need your guidance in that area. 







Subject: 


FW: Re: DCS 3000 


3 you ship l 1 3 graphics cards for me. 


|OTD) (FBI) 

St 12, 2006 10:47 AM 
J(NK) (FBI) 


UHCLAOQIHEP — 

NON-RECORD 


Actually we have about 1 0 cards here just for that purpose. Would you just want the cards or for us to 
install/test them? 


IZZI 



^ 

Subject: 

Re: 


I NKHFBO 

September 1 2, 2006 10:37 AM 

JOTD) (FBI)l 'l(OTD) (FBI) 


Guys, we are interested in getting (3) three dual graphics cards for our DCS 3000 machines. V 
might be good to allow the monitors of the Title Ill's to be able to monitor the DCS 3000 and th< 
I p t the same time without toggling back and forth. What are your opinions of this? 




lINfl ftS9IWE€> 



- BWOLAGBIMFn - 

l(OTD) (FBI) 

From: I f NK) (FBI) fc ;c 

Sent: ' ThurerU SeT35mE£rl4 2006 3:11 PM 

To: I ,, ~ I oTD)(FBI) 

Subject: RE: DCS 3000 Pen update 


UNOLA SSI H E fr 

NON-RECORD 


Yeah, it was [ 


] 


— Original Message--- 

From: | |OTD) (FBI) 

Sent: JSubB S5E55 er 14, 2006 1:55 PM 

To: I | NK) (FBI) 

Subject: RE: DCS 3000 Pen update 


b2 

fo6 

lb7C 

fo7E 


NON-RECORD 

Taive vou a newl I Usually the ! T format that they use is the 10 digit phone number 


i s I lvnn will need to know that in order to provision th^ jcorrectly. 



fo2 

foe 

lb7C 

b7E 


— Original Message-- , 

From: | JNK)(FBI) 

Sent: Thursday, Septembe r 14, 2006 1:52 PM 

To: I | (0TD) (FBI) 

Subject: dS 3ooo Pen update 


be 

b7C 


NON-RECORD 



I don't know if you need to know the Case ID for that one I told you was moving from l 
know if you need to know the change or whom I need to let know that. Thanks for all the help. 


saC 


Newark Dj 
(W) (973f 
(C) (201] 


13, firm 


b2 

be 

b7C 

b7E 


Let me 


SECRET 


From: I 1 (0TD)(FB1) 

Sent: Thursday. Septembe r 14. 2006 1:55 PM 

To: | |NK) (FBI) 

Subject: kt: uus auuu pen update 


UHGLAS Oirj E P- 

NON-RECORD 



](Jsually the ! "T armat that they use is the 10 digit phone number followed 
] You will need to know that in order to provision the l t orrectlv. 


hlO 

h7E 


— Original Message- — 

From: I ~"“T mK) (FBI) 

sent ■ Thursday. September i 4 , 2006 1 : 52 pm 

to: 1 J(OTD) (FBI) 

Subject DCS 3000 Pen update 


bo 

b"/C 


U HCLACCin EB 

NON-RECORD 


□ 

I don't know if you need to know the Case ID for that one I told you was moving fro m| 
know if you need to know the change or whom i need to let know that. Thanks for all the help. 

sa| 

NewarF! 

(W) (973 
(C) (201 


he 

hie 

b7E 


] Let me 


UHOLAOGin EB 


25 




IET 



□ , , 

I don’t know if you need to know the Case ID for that one I told you was moving from l I Let me know if 

you need to know the change or whom I need to let know that Thanks for all the help. 

fc -2 
b6 
b7C 
b7E 








|OTD) (FBI) 

Ti iociHa» Santemhar 12, 2006 3:12 PM 
j OTD) (FBI) 

Springfield Page 


^ FTP I wL 


FyT i was paged last night (9/1 1/06) at 8:39PM by the Springfield FO for information and 
possible assistance in a Kidnapping case involving f | phone. I advised them of 

the technical capabilities and processes for using the uusauuu system. I followed up with them 
this morning and again offered any assistance TICTU/SBIT could provide. 


□ 


J(OTD) (FBI) 
a 12, 2006 1:42 PM 
J(OTD) (FBI) 


3 you ship | | 3 graphics cards for n 


Original Messaa 

From: I 

Sent: T. 


_JNK) (FBI) 

5fl2, 2006 11:55 AM 
J(OTD) (FBI) 


Great, no we could install them. We would need three. Thanks a lot. 


J(OTD) (FBI) 

3 12, 2006 10:47 AM 
(NK) (FBI) 


■U MCkApOirt EP 

NON-RECORD 


27 



lally we have about 10 cards here just for that purpose. Would you just want the cards or for us to install/test 


— original Message — — . 

From: | |(NK) (FBI) 

Sent: lu5&J5v. Member 12. 2006 10:37 AM 

T °b' ~ ~ l (OTD) (FBI); !' I OTP) (FBI) 



NON-RECORD 


Guys, we are interested in getting (3) three dual graphics cards for our DCS 3000 machines. We thought this 
might be good to allow the monitors of the Title Ill's to be able to monitor the DCS 3000 and th^ | |at 
the same time without toggling back and forth. What are your opinions of this? 1 1 



IZ= 

From: 

Sent: 

To: 

Subject: 


IOTP) (FBI) 


RE: Re: DCS 3000 


INK) (FBI) 

02, 2006 11:55 AM 
l(OTD) (FBI) 


~O I »i eLA00ir 4ED 

NON-RECORD 

fob 

■b7C 

Great, no we could install them. We would need three. Thanks a lot. 


— Original Message 

From: I I OTP) (FBI) 

Sent: Tuesday. September 12. 2006 10:47 AM 

To: I ~ (NK) (FBI) 

Subject RE: Re: DCS 3000 


NON-RECORD 


28 


SECRET 



SECE&F^ 


Actually we have about 10 cards here just for that purpose. Would you just want the cards or for us to install/test 


From: | |(NK) (FBI) 

Sent: Tuesday. SeotemEer 12. 2 006 10:37 AI 

To: I l (OTP) 

Subject: Re: DCS 3000 


Guys, we are interested in getting (3) three dual graphics cards for our DCS 3000 machines. W 
might be good to allow the monitors of the Title Ill's to be able to monitor the DCS 3000 and thq 
the same time without toggling back and forth. What are your opinions of this? 




Guys, we are interested in getting (3) three dual graphics cards for our DCS 3000 machines. We thought this might 

29 


SEeflET 



I (OTP) (FBI) 

Ptember p 7. 2006 9:33 AM 
] (OTO)(CON) 
I fOTD) (FBI) 
Justification 


UHCLASEIElgD 

NON-RECORD 


Here is the blurb: 

This software is required to enable the Telecommunications Intercept and Collection Technology Unit to support the field 
with remote diagnostics and troubleshooting of all DCS-3000 systems in the field offices. As new DCS-3Q QQ systems get 
deployed to Resident Agencies and Joint Terrorism Task Force facilities, the TICTU needs| (censes to be 

able to support those installations. i— — i 


30 




fo7<cr 




From: 

1 h 

□ (SO) (FBI) 




r ?nn6 8 05 PM 


To: 

1 

fOTD) (FBI)l 

|(OTD) (FBI)f 

Subject: 

1 JOTD) (FBI) 

DCS3000 




L:!innrr 



NON-RECORD 





The Client update feature is working great. Thank you! 


v added tcoveraae of the N ew England (Boston) and Nashville (Arkansas) markets to our 

Is ides. Is t here an ything that needs to be done at ERF? At your. . 

f ase confirm that our multiserver and ferver are correctly configured for targets (619)1 | 

Thanks. 1 1 


1 (OTP) (FBI) 


From: 

Sent: 

To: 


Cc: 

Subject: 


II ”l(OTD) (FBI) 

1 uesaav. Auaust 29, 2 UO 6 8:09 AM 


'U— mSw 1 ., 

rrcrrJn ifr/S i 

I IQTDIiFBIVl 

““toum , |iUIU, 7 l 

l-W!| tTSmote Access/Maintenance Enhancement Request ^ 

b7C 

hZ 


RECORD 268-HQ-1 045581 


fyi 


— Original 

From: 

Sent: 

To: 

Subject: 


J(CO) (FBI) 

2006 5:29 PM 
l (OTD) (FBI) 

*E | R emote Access/Maintenance Enhancement Request 


RECORD 268-HQ-1 045581 


be 

b7C 


I think it is a great tool for remote access. Currently being utilized by others with great success. Full support from here. 
Thanks, 


i p rhnicaiTHvi sor Columbia Division be 

803l (office) b?c 

803 | ( cellular) 


31 


^etrr 



Greetings, 

In an effort to improve the remote access/remote maintenance capabilities of th j fc yst em. the DCS-5000 Program 

Office wishes to get "Buy-in" from the field. We're currently evaluating software application ^ I 

I ]W e would like to integrate the application software into the Windows boxes, such as: TIU, FAS, 

WinDB, and MW. The application would be controlled and it would be used primarily to assist and expedite 
troubleshooting. There are certainly other advantages for this application. It is used quite extensively on the DCS-3000 
machines. If anybody has concerns or objections, then I want to hear from you. Please help me understand your 
objection. Feel free to call me, or send an email. Thanks for your continued support and cooperation. Hope all is well 
and thanks for your time. 


Peace Out. 






In an effort to improve the remote access/remote maintenance capabilities of the I system the DCS-fiOOO Program 

Office wishes to ge t "Buy-in" from the field. We're currently evaluating software appncations l I 

| I W e would like to integrate the application software into the Windows boxes, such as: TIU, FAS, 

W/nDfcS, and H/iw. the application would be controlled and it would be used primarily to assist and expedite 
troubleshooting. There are certainly other advantages for this application. It is used quite extensively on the DCS-3000 
machines. If anybody has concerns or objections, then I want to hear from you. Please help me understand your 
objection. Feel free to call me, or send an email. Thanks for your continued support and cooperation. Hope all is well 


33 
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Greetings, 

In an effort to improve the remote access/remote maintenance capabilities of the l I vstem thP nrs-^nnn Prnnram 

Office wishes to ge t "Buy-in" from the field. We're currently evaluating software applications ! I 

| |W e would like to integrate the application software into the Windows boxes, such as: TIU, FAS, 

WintiB, and MW. The application would be controlled and it would be used primarily to assist and expedite 
troubleshooting. There are certainly other advantages for this application. It is used quite extensively on the DCS-3000 
machines. If anybody has concerns or objections, then I want to hear from you. Please help me understand your 
objection. Feel free to call me, or send an email. Thanks for your continued support and cooperation. Hope all is well 
and thanks for your time. 



- SCOn E T 


35 


-seeRn 


From: 

Sent: 

To: 


Subject: 

Importance: 


b2 

b7E 


iTDHFBI) 







1 1 UMTiailT — i M 





Ijs 


MOSC 


High 


J’Ei'J 


PROBLEMS 


NON-RECORD 


lb7C 

b7E 


Ahnnt a month ago we received a pen order from ou l H RAforal {subscriber. Long story short, 

| |s not CAL EA compliant at their switches and t he only way we CJJH get pen IfllU 155 mru daily faxes, and then 

manual uploads by an | | 

After being passed to several people, we ended up with the th eir tech quyj { doesn't really seem to grasp 

our whole DCS-3000 system, etc. Anyway, his number is (260 | p nouia any or ya 11 wish to call him. But until they 

get CALEA compliant, it seems we're SOL. 


Tec hnical Adviso r. New Orleans 
(504{ |Office 

(504 {Cell 


[ 


From: 

Sent: 

To: 

Cc: 

Subject: 


loTPHFB') 


lfo6 

lb7C 


□ (OTDKFBI) 


Wednesday A, must 93 POOR 1(VS5 AM 

tom (FRn 


1 luiun ran- 

I h r.s 


JUIU) (l-BI) L 


l(OTD) (FBI);|_ 


SFNSITIVF RUT IINH flSSIFIFD 
NON-RECORD 


fc >2 

b7E 


fet the USCG a copy of the DCS3000 install software. They are pursuing an intercept on a 


target ■ i 

and req uire the DCS 3000 software suite to accomplish this. She is being assisted bj | p f the DEA 

issues. I { has used the DCS with this earner before and I hope will be assiting hfer in configuration sine 
are both out of Miami. 


on networking 
since they 


□ 


be 
to 7C 


SECRET 




From: I l)TD) (FBI) 

Sent: I uesdav.' August Tl . ^006 9:44 AM 

To: [OTD) (FBI) 

Subject: 1 \-W. LALtA NdrtiBlrs 


SBCMHWNOFORN 
RECORD 315 





be 

b7C 

From: 

|(OTD) (FBI) 


Sent: —Luusd^. 

To: 1 

it, zuuo pm 



Cc: 1 

rOTDHFBDi 

l(QTD) (FBI)^ 

Subject: CALEA Numbers 


OCCRETZ/NOFORN 
RECORD 315 

be 

fore 



}0TD) (FBI) 


[ZZ] 

Here are the CALEA numbers for 2006. There are multiple ways to present the information. The two I chose are: 1) new 
lines added in CY 2006, and 2) lines intercepted in CY 2006. 


New Lines Added in CY 2006 


b2 

b 7 E 


Lines Intercepted in CY 2006 


b2 

b7E 


Note these numbers are for CALEA-enabled intercepts supported by the DCS-3000 system. Tha i I numhers will 
comletely overlap with the DCS-5000 numbers, and a portion of the criminal numbers will overlap with the DCS-6000 
numbers. 




SC O RCT Z/NOF ORN 


S E CR ET // NOFORN 


be 

b7C 
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(OTD) (FBI) 
00610:24 AM 
OTD) (CON) 





| (OTP) (FBI) 



Just wanted to take a moment and sincerely thank you guys for everything you do to assist us. 

The recent DCS 3000 solution you provided that allowed us to get pen data to o u r I location and into the £'7E 

VoiceBox system has been invaluable. Instead of providing pen data for what was expected to be a short period of a few 
days, it continued to provide data to our Title Ills for two weeks. The restore process failed when attempting to import data 
from the old version at Chelsea into the new version at the CMP. The problem was solved last week, but your equipment 
allowed us to have a mangeable problem instead of a major headache. 

I hope we provide the kind of support to those we assist that you provide to us. 

Thanks again, 

From all of us at the New York CMP 


| l(OTD) (FBI) b7c 


From: 

Sent: 

To: 

Subject: 

Importance: High 


__](OTD)(CON) 
2506 8:46 AM 


K OTO) (FBI) 

FW: Immediate inspection data call... URGENT!!!! 


UMCLABSIB EB- 

NON-RECORD 


(O) 703- 

(P) TOS- 
CO) 703- 


]CTU ISSO 


be 

b7C 


— Original Mess 

From: 

Sent: 

To: 


■i-W! inwMiaie inspect, 


Importance: High 


"jOTD) (FBI) 

fT+06PM 

rOTD)(CON) 

Son data call... URGENT!!!! 


NON-RECORD 


□ 

I hope you can help with the following request. I'll be out 
questions that you may have just as well as I can. 


of the office until 8/28, but | | will be here and can answer a 


Thanks, be 

□ 


SECRET 



All: 


Attached is a DOJ form that MUST be completed ASAP!!! 

Answer the questions to the best of you ability, with "unvarnished" answers!!! The inspectors WILL compare your written 
responses with their actual finding during the inspection. If the answers are "NO, or I don't know", so state... do NOT 
fabricate answers that can not be verified/proven. t 

Once you've completed the form... CALL me for submission instructions please!! ? [: 


Specific questions about the form should be addressed to the inspection PO< 


d — l@ 2 



rrss ocio ceed 

HANDBOOK - Merg.. 




41 


S£6ftET 




| | run this through the project leads to make sure it is accurate and that nothing is "exaggerated" or out of place. 

□ Look over the DCS-3000 stuff for the same things. 


Let me know the validity of the report. 



NON-RECORD 


The attached report provides information related to the services provided by the ETMU staff in support 
of TICTU during July 2006. The data is compiled from our SOIL, CSOC, Facilities Engineering, and 
Logistical Engineering staff as well as the DCSP System Administrators and Analysts deployed around 
the country in support of TICTU fielded ELSUR collection systems. I hope you find this information 
valuable. 


42 


- SCCR I IT — 


|(OTD) (FBI) 


|(OTD) (FBI) 

E: Report for TICTU - July 2006 


From: I I OTP) (FBI) 

Sent: Thursday. Aunnsf 17 . 7006 

To: I I fOTDI (FBI) 

Subject: FW: Report for TICRJ - July 2006 


Whatd did/does this pay for. 


jelecommuir\icat\on& Intercept & Collection Technology Unit 


g | 


JS£eRET 





Thanks | | could you please send me the Tech Tips. Thanks. 



NON-RECORD 


bo 

b7C 


secret 



J&Re-r'' 


^ Some field offices are saving the information to a directory on the machines C: drive and then using either the 

creation methods to burn the target information onto disks. | ~\ \$ working on a "Tech Tips" best practices edition 
for how this is being done. ■ ■ 

However, that said, we are invesitgating the use of the dreade d I There are many 

policies to cons ider in using this 

type of media. I f rom New Haven is working on these issues. She is feeling out the potential hurdles 

we might face. The first , 

one she is look ing at is taking a data storage device from an unclassified (DCS 3000 Cleint) to a classified ! I 

I fc vstem. 

She has found out that the l I MUST have write protection capabilities and that write protection must be 

on befo re connecti ng the 

drive to | T rhis is so the Classified system can not write to the media, which makes sense. There are scanning 
for virus issues and othe 

things that still need looking at. So, that is where we are at. Call me if you want a pre-edition of the Tech Tips from 
r fr r want to discuss this. fc2 

Also, there is the evidence issue. I have always been told "first removable media.” I am not a lawyer however. be 


— Ori ginal Message — 

From: I I NK) (FBI) 

Sent: Monday. August 14. *006 1:39 PM 

To: I If OTDl (FBI) 

Subject: Re: DCS 3000 CD-RW'S 


Do you know how other Divisions are upload the information from DCS 3000 to TA using the cd's. 





NON-RECORD 


E run this through the project leads to make sure it is accurate and that nothing is "exaggerated" or out of place. 

I Look over the DCS-3000 stuff for the same things. 

I 5b 7 C 

Let me know the validity of the report. 

□ 



NON-RECORD 


The attached report provides information related to the services provided by the ETMU staff in support of 
TICTLI during July 2006. The data is compiled from our SOIL, CSOC, Facilities Engineering, and Logistical 
Engineering staff as well as the DCSP System Administrators and Analysts deployed around the country in 
support of TICTU fielded ELSUR collection systems. I hope you find this information valuable. 



TICTU Report-July 
06.doc (136 ... 





ELSUR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Operational Te chnology Division (OTD) 

Phone: 7031 

Fax: 703 1 1 | 


-SECRET 



NON-RECORD 


I will need to meet with you and our new ISSO in SMO. Can I schedule something? Just a meet and greet type thing.. No 
longer than 1/2 hour 45 minutes. How about 1 :30 Wed?? 





:CRET 


From: 

Sent: 

To: 

Subject: 


I I (OTP) (FBI) 

Tuesday. Augus t 1 5, 2006 8:56 AM 
| |(OTD) (FBI) 

1 Uh: T55P 1 


blC 


NON-RECORD 


am the ISSO 
for DCS-5000 is? 


for the DCSNET.[ 
Hope this helps. 


]is the ISSO for DCS-3000. 


— Original Message 

From: | ICOTO) (FBI) 

Sent: MflniW AUOTSt 14 2006 3 : 10 PM 

To: I I (OTD) (FBI) 

Subject: ISSO 


NON-RECORD 


Are you the ISSO for DCS-5000 or is | | for all TICTU?? 


TOC 

om 


Phvsiral Sernritv Rnpnialist 


b6 


1 don’t know who the ISSO 





From: 

Sent: 

To: 

Subject: 



NON-RECORD 


h'Z 

fo6 

b7C 

b7E 



1=1 


! 'ces are saving the information to a directory on the machines C: drive and then using either the) 

o burn the target information onto disks ] [ is working on a "Tech Tips" best practices edition for 
how this is being done. 

However, that said, we are invesitgating the use of the dreadej~" | There are many 


policies to con sider in using this 

type of media j ~ from New Haven is working on these issues. She is feeling out the potential hurdles we 

might face. The first 

one she is looking at is taking a data storage device from an unclassified (DCS 3000 Cleint) to a classified l I 

I * system. 

She has found out that the | | MUST have write protection capabilities and that write protection must be on 

before connectin g the 

drive to ] | This is so the Classified system can not write to the media, which makes sense. There are scanning for 

virus issues and othe 

things that still need looking at. So, that is where we are at. Call me if you want a pre-edition of the Tech Tips from | | 
or want to discuss this. 

Also, there is the evidence issue. I have always been told "first removable media." I am not a lawyer however. 


□ 


— Original 

From: 

Sent: 

To: 

Subject: 


ter ms warn 


If OT P) (FBI) 


b2 

fc7E 


NON-RECORD 


lb 6 
b7C 


□ 

Do you know how other Divisions are upload the information from DCS 3000 to TA using the cd's. 



fET 


From: 

Sent: 

To: 


\})\ 


(HN) (FBI); 


-ra|_ 1 liPXUC^N)J 

(OTP) (FBI) I ^» LA) (Ci 

Power Outage Friday 8/18/2006 


I have been notified by 
from 6:00 p.m. to 2:30 ' 




:hat GSA will be shutting down all electrical service to the Federal Building on 8/18/2006 


Therefore to bring down all of the com puters in the CMP gracefully, we (tech guys) will be shutting down th j I 

| | DCS 3000 and any other system that I forgot about on Friday 8/18/2006 at 4:30 pm. 

You will need to turn off your computers and shut them down (turn off the electrical system) at that time. This includes all 
of the printers and anything pIsp mnneoteri to an electrical plug to include the UPS systems. If you don/t know how to do 
it, please let one of us (myselt j | know prior to Friday. 

All of our collections will cease as of that time until we get back in on Saturday 8/1 9/06 to turn oh all of the systems. 

| | Please turn off youi| [computer & printer prior to COB on Friday 8/18/06. 







NON-RECORD 



I think it best if someone from your office replies ! i s asking if your office enables the[” 

for each pen-register (criminal and FISA) target as a matter of policy/practice. The d efault onTI 

allow the i l after the call is setup unless the check box called ! 

for each target. I iu st checked vo ur crim inal DCS-300 0 system, and the vast majority are set tcj 

you're not collecting | | just the ! I dialed at the Kojinninn of t-ho roiic w tho 

I assume this is due to policy/practice in the office. If so, your response tcj 

cases. i— ——————— 



-SECRET 



Please se« 


jemail below and respond directly back to him as soon as possible. Thanks! 



Subject: Not a survey 

Importance: High 


J>TD) (FBI) 

2006 8:14 AM 
OTD)(CON) 

)TD1 fFBDr 


l (OTD) (FBdT 
J(OTD) (FBI) 




NON-RECORD 


C3 


lease forward to all TS/TA’s for a response. 


Ladies and Gentlemen, 


be 

b7C 


Can everyone please send me a ver^shortreponse on the practice your offices follows in t he us e of the DCS- 
3000. Do you ONLY capture the j p f numbers or do you use the toogle to capture j j numbers. . 

Since there are many options available to us on how much dialed information we collect we need to know what the 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 

b6 

Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 b?c 
allows. 


be 

b7C 


IZ=] 


ss/T 


^ 11 1 echm cal 


O: 5401 
C: 202- 


] 


Personnel Development 


Unit 


- UNGLA 66I R 6&- 


- WNeLAGGIR SO 




UHGLAGS i n ee 


53 


■ SECR^ -F- 



Subject: Not a survey 

Importance: High 


NON-RECORD 

to 6 

| | to7C 

I p lease forward to all TS/TA’s for a response. 

Ladies and Gentlemen, 

Can everyone please sen d me a very short reponse on the practice your offices foll ows in the use of the DCS-3000. 
Do you ONLY capture th q fr f numbers or do you use the toogle to captur j \ numbers. b 

55 


-seeffFT 






Since there are many options available to us on how much dialed information we collect we need to know what the 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 

Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 allows. 
Martin 



techni cal Pe rsonnel Development Unit 

0:540 

C: 202 

be 
to 7C 


S E NS I T I VE PUT UMGLAGOinCO 



OTD) (FBI) 



From: 


JNK) (FBI) 

lb .2 

Sent: 

| Monday, Auqu^Mj 

!u06 1:39 PM 

lb 7 E 

To: ] 

Subject: 

1 Ke: DCS 3UUU CU|_ 

llQID) (FBI) 

b 6 


b7C 

0 WCLA33 II ILD 
NON-RECORD 


□ 


Do you know how other Divisions are upload the information from DCS 3000 to TA using the cd's. 



■WNffLASSinEft 


56 


js&eftrr 



please forward to all TS/TA's for a response. 


Ladies and Gentlemen, 


Can everyone please a 
you ONLY capture thJ 


■very short reoonse on the practice your offices follows in the use of the DCS-3000. Do 
pf numbers or do you use the toogle to capture j~~| umbers. 


Since there are many options available to us on how much dialed information we collect we need to know what the norm is 
around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just looking for the 
norm in your office. j b6 

lb 7 C 

Thanks for your quick response The legal guys need this information to talk to all the options the DCS-3000 allows. 






NON-RECORD 


All, 

Please seeQ 


^ernail below and respond directly back to him as soon as possible. Thanks! 


be 
. b7C 


— Original U 

From: [ 

Sent: 


□« 


' imiC 


2006 8:14 AM 


J0TD)(C0m 
Tomi tfRiyf 


Subject* Not a survey 
Importance: High 


□OTD) (FBI) 




Umi£§uC 


J(OTD) (FBI)L_ 


tmtM i l ’ mTO I 


WjgfaAjgjHgg . 

NON-RECORD 


D 


lease forward to all TS/TA's for a response. 


Ladies and Gentlemen, 


be 

b7C 


Can everyone please ser 
Do you ONLY capture tht 


short reponse on. the practice your offices follo ws in 
[of numbers or do you use the toogle to capture | j 


the use of the DCS-3000. 
lumbers. 


be 


Since there are many options available to us on how much dialed information we collect we need to know what the b?c 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 


Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 allows. 



l 1 

i ecnmcai Personnel Development Unit 

0:5401 I 

C: 202| 


be 

b7C 


’ ttnoLACSiroEa. 

U N CLAS S IH SP. 


60 




(IP) (FBI);r 
lOkiifBI)] 


(FBff 


(PX) (F8i)T_ 
(NK)CESUC 

(FSI) | 




~1ph| a 


IQ)(FBi)T 
_Llr) (f* 

l 




~l fpm fFBjj 


3 3A) (FBI)F 
MO) (FBlJ - 


" OTtCLAOGtW CD 

NON-RECORD 


□ (SD) (FBI)E 


3 cg) (FBI)I 
If NO) fFE 


JCV) (FBI)C 


ES) 


□jk) 


be 

b7C 


All, 

Please se< 


smail below and respond directly back to him as soon as possible. Thanks! 


— Original Message^^_ 
From: | 

Sent: Monday 


r~ K OTP) WT 

Subject: Not a survey 

Importance: High 


a OTD)(CONl 
TPHranf 






pPTTWC 


""lOTffl f ffld 


v mm C 


□apj 


NON-RECORD 


3 j please forward to all TS/TA's for a response. 
Ladies and Gentlemen. 


be 

b7C 


Can everyone olease send me a very short reoonse on the practice your offices 
you ONLY capture tha [of numbers or do you use the toogle to captun 


!£j 


in the use of the DCS-3000. Do 
lumbers. 


be 

b7C 


Since there are many options available to us on how much dialed information we collect we need to know what the norm is 
around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just looking for the 
norm in your office. 


Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 allows. 


nn 


ssaI 

Technic* 
O: 540f 
C: 202-1 


_EfiEspnnel Development 


Unit 


bo 

b7C 


unLLAJbii tso 


SEgfiET 


62 






NON-RECORD 


At the risk of sounding lazy, is it possible to have an auto-update feature that would allow the input of a target into the 
warrant database on one client that would then allow you to select other clients you would like to populate with this same 
data. For many different reasons, some good, some not so good, we are in a position where we have the same target in 
multiple clients and not all are always remembered to be update at renewals. 



Greetings. 

I am checking in to see if you have had a chance to install theQ 
received at the RTL conference in Tampa. 


package Q 


]etc) you 


If you haven't, please take some time this week, to do so. I would also like to run a few tests with each of you with a test 
phone to confirm it’s working. 


You will need to work with ! Hon the DCS-: 

| | He can be reached at 702 | | 


■3000 s 


o be able to configure your 


target for theQ 


Please let me know if and when you have completed the install and tested it. 
If I don't hear from you I will start calling you and bugging you. :-) 

Thanks. 


703T" 

816 ^ 


Hwork 


JeU 


he 

hi C 


UMlTlAgfilHEP- 


S£C$ET 


b 7 C 
b'7E 


I I (OTP) (FBI) 


(Sf 


From: 

Sent: 

To: 

lubject: 


§*§3- 

coRa 


I |(WF) (FBI) 

Friday AuausH%-?00 6 1 1 :39 PM 
I I (OTP) (FBI) 

DCS 3000 


IZZI 


Just wanted to touch base with you on the Friday incident with th£ 
We got all four number is and they all downloaded. “ 

70 31 It ook th^JouafiSi . 

pnd 70 3 w ere quick since the c overage fq ; 

ns quick also. It only had call records for | | 

we missing anything on this one?? 


lb 2 

be 

b7C 
b 7 E 


^numbers. 


r them began today 

I thought this one had call records back to March - Are 


Can you check your system and tell me if we have anything pending for the above numbers?? 


Thank you for your assistance and patience. 

IZZI 



- SECRET 


t=z 

From: 

Sent: 

To: 

Subject: 


~[0TD) (FBI) 

I 


DCS Upgrade 


iWF) (FBI) 

8:02 PM r 
j(OTD) (FBI);|_ 


](OTD) (FBI) 


be 

b7C 


NON-RECORD 
HI - 

We ar e upgr ading the DCS 3000 to the latest version and we 
notice the( Iwas not connected. Please check. The system IP bl 

/ \ address | | b 2 

In a couple or weeks we are going to have a power outage on the 
plant and this will effect the DCS 3000. When we start the DCS 

3000 fiygt-tam. T-g fhgrfl a apmiPnr'P on wh-ir-h ono shrmld h* ninninrr 

first? The | I 

i i ^ 

b2 

Thanks # : b6 

I 1 £5 ■ 




65 



JECBHP 


— Orig inal Message- 
From: | 

Sent: Tfturs 

Subject: R3 


July 27, 


t OTD) (FBI) 
, 200f> 7:02 AM 
LAUFBI) 

Mystery 


bZ 

be 

b/c 

b7E 


NON-RECORD 

□ 


be 

b7c 


Since TA is an analytical tool we pass all the dialed digits from the DCS 3000. Have you contacted TA to see if 
they can modify their system to handle this types of called numbers? 


Original Mes 

From: 


St 


Subject: 




>) (FBI) 

006 2:r ' 

3* 


July 24, 2006 2:28 PM 
IOTDHFBI) 


b2 

be 

fo7C 

b7E 


NON-RECORD 


I just spoke wit H i They are familiar with this. They said the customer Is noj 

the 011. Apparently this occurs when the custo mer makes a call that is handed off to the ol df 
network. They claim during the handoff a | p s added. Here is a sample of two calls that were rejected today 
and the associated log file: 







From: 

Sent: 

To: 

Cc: 

Subject: 


t t WCLADGin SP 

NON-RECORD OTHER OUT OF SCOPE 



I will forward the below info, to the Tel Apps people and see if they can get it corrected. 




NON-RECORD 


□ 


Since TA is an analytical tool we pass all the dialed digits from the DCS 3000. Have you contacted TA to see if they 
can modify their system to handle this types of called numbers? 



TRULL; IJUIRCD 
NON-RECORD 


69 






NON-RECORD 



Hi guys. 


I have a quick question abou ^ 1 This may be something you have long been 

aware of but, <sinrA i hwt nr**ti cinlng ih«> npinnri* | have not seen it before. On some outgoing 
local calls with | | pens the raw data indicates a Oil was dialed before the 

number. As a resulf this number does not get uploaded to telephone apps. Instead the call is 
rejected as an error; "MISSING TO NUMBER." These are completed calls, with a duration. This is 
occurring with different targets on unrelated cases. All are outgoing calls frorr l "T 

phones to local numbers here in LA. I can't believe would be dialing 01 1 before they make a 
local call. Do you know why this is happening? 

™ [ I H 

lb7C 

fc.7E 


• QNOLAGG i r HiD 


| (OTP) (FBI) 

From: I l oTD) (FBI) 

Sent: Thursday .luh/97 9:53 AM 

To: I fc OTD) (FBI) 

Subject: FW: He New DCS 3000 Computer 


NON-RECORD 




Have you seen an RMS for this? If not can we send it to him (when time permits). 


2 f 

Subject: 

NON-RECORD 

□ 


Re: New D& MM Computer 


(NIC) (FBI) 
16 3:08 PM 
|(OTD) (FBI) 
IK) (FBI) 


be 

b7C 


S66RPT 


"3CCRF 1 


I don't know if you remember speaking to us or not regarding replacing our "front room" DCS 3000 machine. The one we 
are using now is attached to the CDNRS machine. We what to remove it from the CNDRS and start having the lAs 
downloading from the DCS 3000 instead of the CDNRS. The problem with the old machine is that it does not have a CD 
burner. Is it possible to send us a new DCS 3000 computer? Thanks. 








72 


-SECRET 






— UHGLfl |C|cr> 


73 


J&6fiET 




I cannot ping the pix. So, what we need to check is: , 

are you looking at the correct pix? the one I show in the database is| § 
power? is the pix powered on 

cables? the ethernet cable from eO should be plugged into the same switch as the dcs-3000, if so, unplug and replug from 
both ends 

connection lights? did the lights on the ethernet port come on when you plugged the cable back in 

if no connection lights, then try a different cable. r- i 

ping working now? try pinging from a command prompt on the dcs-3000, type: ping J 

if no response, try rebooting the pix 

hopefully one of these steps will fix it, otherwise the vb guys may need to send you a new pix. b 1 

I'll be in until 4:30 or so today if you want to give me a call this afternoon. 



if I am contacting the right person, if not, redi rect mv e mail. See below info sent tc | | ref the 

DCS3000. As mentioned, we are se tting up a pen on a l b hone, CDC going through the to the l I 

We also want the CDC info going to | f as this will eventually become a Till. DCS3000 is set up and 

receiving the CDC on the line but it i! I!(J[ going ro VB. We cannot ping it from VB. JSI believes there is a connection 
issue with the DCS3000. Don't know enough of the DCS3000 etc. to do much good. 

Can you provide us with info to trouble shoot? P.herkeri the Pix | | had a yellow cat 5 out of the EthernetO 

(yellow) port to the 3 Com Switch) as | T wanted me to check. Set up between the Pix and switch is same, has 
not changed from original setup years ago. 



TT A Honolulu D ivision 
808 Desk 

808 Cell 


Original 

From: 

Sent: 

To: 




defter 


Subject: 


RE: DCS3000 





^-SEeRTr 

1 (OTP) (FBI) 


From: 

Sent: 

To: 

Subject: 


i muTTO — 

FW: DCS3000 


(HNHFBI) 

HQ6 5:56 PM 

3° td ) (FBI)LZ 


□DTD) (FBI)L 


NON-RECORD 


b7C 

b7E 


□ 

Not sure if I am contacting the right person, if not, redir< 
DCS3000. As mentioned, we ar e setting uo a pen on 1 


email. See below info sent tcT 


^Href the 

|phone, CDC going through the ucsjuuu to the l I We 

also want the CDC info going to j l as this will eventually become a Till. DCS3000 is set up and receiving the 

CDC on the line but it is not going to VB. We cannot ping it from VB. JSI believes there is a connection issue with the 
DCS3000. Don't know enough of the DCS3000 etc. to do much good. 


Can you provide u s with info to tro ub le shoot? Checked the l I had a yell ow ca t 5 out of the EthernetO 

(yellow) port to the l | a j I wanted me to check. Set up between the | | and switch is same, has not 

changed from original setup years ago. 


808T 

8081 


— Original MessMe^_ 




NON-RECORD 


be 

b7C 


□(HN) (FBI) 


b2 

be 

b7C 

b7E 


(S) I cannot ping the outsidef~ 


... =3 DCSnet side) of the firewall. C heck the cables on the l I the outside 

(EthernetO shown in Yellow) should have a CAT-5 cable connected to th j | the switch the DCS-3000 and 

routers are connected). 


□ 


— Original AT 

From: |_ 

Sent: 


NON-RECORD 


[=□ 


J(HN) (FBI) 


•QTD HFBn 




□hnkfbi) 


to 6 
b7C 
b7F, 


Have been setting up a pen register for a | I line in i .. rr 

working in the DCS3000 but for some reason VB does not have access to the DCS3000. JSI suspects th j^~| firewall 


] and in the DCS3000. Appea rs to b e 


-seeRFf 



UHGLAOO irig P 



NON-RECORD 


1 don't know if you remember speaking to us or not regarding replacing our "front room" DCS 3000 machine. The one we 
are using now is attached to the CDNRS machine. We what to remove it from the CNDRS and start having the lAs 
downloading from the DCS 3000 instead of the CDNRS. The problem with the old machine is that it does not have a CD 
burner. Is it possible to send us a new DCS 3000 computer? Thanks. 


77 





_^E6R er ’ 


Press enter to go to the next screen where you can enter a date range, if you want to. This will submit the report. 


Yes it has been quite a while since we met and I think that it would be a good idea to meet again. We have some 
people out on vacation for the next 2 weeks, but should be able to meet after that. Does that work for you? Do 
you have some ideas of what you would like to discuss? 


□ 


h 2 
be 
hie 
b7E 


— Original Messa ge — 

From: I If OTP) (FBI) 

Sent; Fri d ay. July 21. 2006 9:32 AM 

To: | |IT0D)(C0N) 

Subject: statistics on Pens 


NON-RECORD 


□ 

Trias 


Have an inquiry about statistics for pen uploads. T1CTU is asked frequently how many intercepts we 
are supporting. Since we provide capabilities and equipment but don't actually perform the intercepts, this 
is a request which is very difficult for us to get. However, in thinking about this it occurs to me that our unit 
does support the field with equipment for all the pen uploads from the| land the DCS 3000 sources. 

My 

statistic for how many unique target phone numbers from our unit's supported systems 
lat are input into TA can be obtained? At this point this is an informal fact finding 


request. 

It has been a long time since we all met and given the fast moving nature of telecommunications I think we all 
need 

to have another meeting. Let me know what you think about this. 


Thanks, 

1 , I he 

(763) | | fove 


-B UT UNCLA SSI FIED 


B UT UNGUAS6 I F I SP 


SENS I T I VE 


CCMOIT.I/C gj IT uMgf n igiPiPn 


79 


Subject: Statistics on Pens 



be 




NON-RECORD 




nave an inquiry about statistics for pen uploads. TICTU is asked frequently how many intercepts we 
are supporting. Since we provide capabilities and equipment but don't actually perform the intercepts, this 
is a request which is very difficult for us to get. However, in thinking about this it occurs to me that our unit 
does support the field with equipment for all the pen uploads from the l l and the DCS 3000 sources. My 

question is whether a statistic for how many unique target phone numbers from our unit's supported systems 
i e nd DCSPC) that are input into TA can be obtained? At this point this is an informal fact finding request. 
It has been a long time since we all met and given the fast moving nature of telecommunications I think we all 
need 

to have another meeting. Let me know what you think about this. 


Thanks, 

I . _ L 

(703 1 □ 


to 6 
b7C 


BUT UMCIASSIPIEP 


UMCLAfiSIEtEO 


TYERYAR, KEITH A. (OTP) (FBI) 




£ jSEetfET 


— Original Mea-wnp — ■ b6 

From: | PTD) (FBI) h7n 

Sent: , Frirtev miv?i ? nnfi 9:32 AM 

To: I □ (rTOD)(CON) 

Subject: Statistics on Pens 

ecueiTiuc a UT UMCLASSI»fiD- 
NON-RECORD 


b2 




i nave 


i nave an inquiry about statistics for pen uploads. TICTU is asked frequently how many intercepts we 
are supporting. Since we provide capabilities and equipment but don't actually perform the intercepts, this 
is a request which is very difficult for us to get. However, in thinking a bout this it occurs to me that our unit 
does support the field with equipment for all the pen uploads from the f H and the DCS 3000 sources. My 

O is whether a statistic for how many unique target phone numbers from our unit’s supported systems 

nd DCSPC) that are input into TA can be obtained? At this point this is an informal fact finding request, 
en a long time since we all met and given the fast moving nature of telecommunications I think we all need 
to have another meeting. Let me know what you think about this. 


Thanks, 



be 

fo7C 


| (OTD) (FBI) 

From: I l OTDI (FBI) 

Sent: Friday. July? 1.200 6 9:32 AM 

To: | |ITOD)(CON) 

Subject: Statistics on Pens 


SENS I T I VE PUT UNGLAGOir i CD 
NON-RECORD 


I nave an inquiry about statistics for pen uploads. TICTU is asked frequently how many intercepts we 
are supporting. Since we provide capabilities and equipment but don't actually perform the intercepts, this 
is a request which is very difficult for us to get. However, in thinking about this it occurs to me that our unit 
does support the field with equipment for all the pen uploads from th ^ ~| and the DCS 3000 sources. My 

S is whether a statistic for how many unique target phone numbers from our unit's supported systems 

nd DCSPC) that are input into TA can be obtained? At this point this is an informal fact finding request, 
en a long time since we all met and given the fast moving nature of telecommunications I think we all need 
to have another meeting. Let me know what you think about this. 


fo2 

bo 


b7C 

fo7E 


Thanks, 

^ l'U3j | ^ I 


sensitive Buxmin ftssicten 


82 






We are anti cipating b eing able to test th d fe nd l It uesday, 7/1 8/06 at approx. 1 1 :00 am HST. This will be 5 

pm EST an d 1 7 a m Wednesday. 

We should know by 1 0:30 am HST if our set up is completed, etc. and ready for the test. Can one of you be available to 
assist if we have problems? 




On Wednesday we will get two bl lines in our office. Do I connect the li nes to on e of the 4 ports on the top right, back side 
of the l 1 using the black splitter connector cables provided with the ! T ? I am usually in by 6:30-6:45 am HST or 
12:30-12:45 pm your time. Send me an email or call if the the set up is not correct. 


We would like to test the lines frnm i l if po ssible on Thursday as it will be Fridav i l ime. If we do it about 1 1 :00 
am HST, it will be 5 pm your time and 7:00 am i l me. Friday. Can you stay till that time or later, to see if it works 
and make any adjustments as needed? We will get back with you once we coordinate the | [ Telephone point of 
contact. 1 J 







]Ti*a 


I rnnnertoH an other not r-ghjo from the | ~| tO the DCS3000 SWitCh [ 

| so I assumed it was not to be used. Hope this is correct. 

On Wednesday we will get two bl lines in our office. Do I connect the l ines to on e of the 4 ports on the top right, back side 
of the l l using the black splitter connector cables provided with the i 1? I am usually in by 6:30-6:45 am HST or 
12:30-1^:4^ pm your time. Send me an email or call if the the set up is not correct. 

We would like to test the lines fronr | I f po ssible on Thursday as it will be Friday . 1 l ime. If we do it about 1 1 :00 

am HST, it will be 5 pm your time and 7:0u am i I me, Friday. Can you stay till that time or later, to see if it works 
and make any adjustments as needed? We will get back with you once we coordinate the l I Telephone point of 
contact. 


^Thank-c 

I 1 a Honolulu D ivision 
80d iDesk 

808 | ' j Cell 


— Original 

From: 

Sent: 

To: 

Subject: 



](HN) (FBI) 
Tms PM 


JHN) (FBI) 


b2 

be 

fo7C 

b7E 


NON-RECORD 


- — Original 

From: 

Sent: 

To: 

Subject: 




NON-RECORD 


b2 

!b6 

b7C 

b7E 


FYI 


— Original 

From: 

Sent: 

To: 

Subject: 



JlN) (FBI) 


b2 
lb 6 
b7C 
b7E 


NON-RECORD 


| [h e new | k hould be hooked up with a patch cable from the ethemet port in the back of the epu to the 

1 ULb iUuQ switch that h as the other DCS3000 machines connected to it. From there we can configure the machine 
using | ] 


asked me to send you six morel 

ig the rack call or e-mail me and I will explain it further. 


1 i will do this today. If you have questions 
The cards can be inserted with the power on in the 


The new CPU has a 


f fc ard in it to answer the phone lines. 


It also has special software to sort and buffer the data. 



SE6RFT 


The targets can be entered into your regular DCS3000 and we will make a connection to thel In your 

multiserver I [ I 


I will be gone this afternoon but I should be here the rest of the week.[ 
My new number is 703 | ~**| anc ^ | is 703 | | 


]should also be here all week. 


■fc6 
lb 7C 
lb 7 E 


Let us know if you need anymore help. 


□ 

tlectromcs Technician 


b6 

b7C 


OTD/ESTSr riCTU 

Phone: (7031 , J 

Pager: (800 1 T 


nrirninr.l Mflccano- 

From: 1 l(HN)(FBI) 

Sent: 1 kiHav 'I'tiTv HAMIIIIk l"i:04 PM 

To: | l(OTD) (FBI) 

Subjectj 1 


b2 

he 

b7C 

b7E 


NON-RECORD 


We put up the l t n the rack near our DCS 3QQQ Did you want to jump into the | | through 

the existing DCS3000 if we connect a | J line to it? If not email me instructions on now you want this done and 
we do it Monday. 

We would like to have this set up for testing prior to us getting the B1 lines (two analog lines) from the l I on 
Wednesday so we can just connect the lines and have Guam test it from there We understand we will need 
I |for the audio portion. Do we need a particular type of| | Email me any instructions how 

you want this done, etc. and we will set it up. 

Can you provide us some info on the function of the | | On the l I t was labeled DCS3000. Is this a 
different configuration DCS3000 to handle the overseas lf T* could we not use the existing DCS3000? 
Any backgroun info is appreciated. | | is not here an q { and I are putting this together. 

n 

UNOLACGI Ptfeft 


b2 

ho 
lb 70 
b7E 


UNCLASSIFIED 

UNCLASSIFIED 

SENSITIVE BUT UNCLASSIFIED 

88 


JSKfi ET 



Can your ISSO provide the information requested for the DCS-3000? 
Thnx, 



JoTD) (FBI)£ 


NON-RECORD 


I need contingency plan results for the following systems; 


Data Collection System 3000 
Data Collection System 5000 


X 


Original Message 

From: 

Sent: 


H(OTD) (FBI) 
302:12 PM 
ZjSecD) (FBii_ 


. rD)(C0N)L 

(U ID n rBT) 

Subject: RE: Contingency plan information 


J(0TD) (CON)Q 


□OTO) (FBI)C 


NON-RECORD 


fee 

b7C 


Per our phonecon 


be able to provide anything you need, 
part of this week. 


3 


|is the ISSO for the systems in question. I'm sure he will 


hough 1 believe that he may be out of the office at least 






%sm. 


ELSUR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Operational Technology Division (OTD) 

ERF, QuanticQ. VA 


bZ 

bo 


— OrKlIml MPTifinP 

From: I k vffl /fru 

Seat: Monday, ?yl Y !?, ^11:26 AM 

To: I , I OTP) (FBI) 

Subject: Contingency plan information 

UNCLASSIFIED 

NON-RECORD 


i neea contingency plan results for the following systems: 

Data Collection System 3000 
Data Collection System 5000 

Thanks. fee 

I I 


UNCLAG0 I F IE&- 


be 

b7C 


u Mc i LABG i n ee- 
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— SECRET 




We'll look into a fix for this on the DCS-3000. You sho uld consult with ! ] 

interim , the only way to comply is set the stop date with i ‘~"b nd then after this 
| A uthorized. 



for a fix for the l I In the 

date reset the stop date withou | | 



NON-RECORD 

h2 
fe.7 E 


Hi guys. 


We seem to be losing the battle regarding use o l j language i n a pen o rder to collect [~ 1 

information. Out here in LA we are seeing many separate orders for | ( collection, with start and stop 

dotes differing from the pen register order. It is difficult to keep track drtd ertsure we stop collection of the 


|at the appropriate time. Is there any way to build a separate stop date into the client software for 
nformation? 
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SI 




From: 

Sent: 

To: 

Cc: 

Subject: 


^|<OTD) (CON) 


DCS-3000 




IfPTD) (FBI) | _ 

i [OTD)(cnim: 


HfilUliFBI) _ 

I (OTP) (FBI);[ 


b2 . 
b7E 


ccMciTit/c qyy UHCI A061HE» 
NON-RECORD 


Attached is the first draft of the schema to be used for sending data from DCS-3000 to l fc lease review it and 
provide comments. 

b2 

, Thanks , be 

I I b7C 

b7E 



.xsd (8 KB) 


bLSUK i e&nnaiagy iv i anagl ment unit 

Electronic SupieillaoceJiechnology Section, OTD 
Phone: 7prJ | 

Cell: 571 1 — 


be 

b7C 


UNCLASS I FIE D 


jsed^ET 
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ISF) (FBI) 

8 12:53 PM 
[OTD) (FBI) 


Sorry to keep hnthorinf 
because it was J I 
terminate in a City of |_ 
investigation and he rel 
went to cyberspace. | 


you] lhad set up a CALEAT-1 inter cept witti ror o ne line.| ladvised tha 

witch, me' CDC could only be sent on a j | went ahead and had an ! 

fc ffice within distance of the CO. 1 asked the case agent if the pen was critical in his 
ited that he would already know who was being called and mainly wanted the CCC, so the CDC 
lhas since put four other targets on the same T-l, but that agent needs the CDC. 


I'm told that the office area thel (terminates is in a 

we can conf irm that it's under the control of the Citvgj 
to us here irl | The plan would be to built a 


;ecnre snare , but I haven’t seen it | h asn't seen it either. If 
I would we be able to put a router the re to connec t up 
"circuit to our co-location in San Francisco then td l/er 


Let me know your thoughts and if it's okay, what I'll need to RMS. 
Do you want me to send an RMS requesting the new DCS3000 for£ 






NON-RECORD 


□ , , 

I connected an ether nar cable from th j | to the DCS3000 switch I I Th j I 

port was taped on th j b o l assumed it was not to be used. Hope this is correct. 

On Wednesd ay we will get two bl lines in our office. Do I connect the l ines to on e of the 4 ports on the top right, back side 
of th j ( using the black splitter connector cables provided with the l T I am usually in by 6:30-6:45 am HST or 
12:30-12:45 pm your time. Send me an email or call if the the set up is not correct. 

We would like to test the lines fro nl t f po ssible on Thursday as it will be Friday, ! l ime. If we do it about 1 1 :00 
am HST, it will be 5 pm your time and 7:00 am | | ime, Friday. Can you stay till mat tima nr later to see if it works 
and make any adjustments as needed? We win get Dack with you once we coordinate th | T elephone point of 
contact. 


I Thanks 



Original 


Sent: 

To: 

Subject; 



HN) (FBI) 

16.2:49 PM 
_](HN) (FBI) 


lb 2 
be 
lb7C 
fo7E 


NON-RECORD 


- — Original 

From: 

Sent: 

To: 

Subject: 




3 (HN) (FBI) 
;58 AM 
' (FBI) 


fo2 
lb 6 ■ 
lb 7 i| 

hit 


UMCLABG tHBfr 

NON-RECORD 


FYI 


— Origina 

From: 

Sent: 

To: 

Subject: 



lb 2 
b6 
b7C 


b7E 


NON-RECORD 


3 h0U,d hooked up with a patch cable from the ethernet port in the back of the cpu to the 

100 switch that has the other DCS3000 machines connected to it. From there we can configure the machine 


94 




I will be gone this afternoon but I should be here the rest of the week. £ 
My new number is 703 | | anc | k 703 | | 


o be here all week. 


Let us know if you need anymore help. 


□ 


Electronics Technician 
OTD/ESTS/ 

.Phone: (703| 

Pager: (8001 


:T.q/ Tir.Ti i 
[703 

800)| 



NON-RECORD 


}tN) (FBI) 

£11:04 PM 
JOTD) (FBI) 


b7C 
fo7 E 


IZZI 

We put up the l i n the rack near pur DCS snno Did you want to jump into theC 


3 through 


the existing DCS3000 if we connect al line to it? If not email me instructions on how you want this done and 
we do it Monday. I— —I 

We would like to have this set up fortesting prior to us getting the B1 lines (two analog lines) from the ! Io n 
Wednesday so we can just connect the lines and have Guam test it frnm thprp Weunderstand we will need 
I "p or the audio portion. Do we need a particular type oi] ] Email me any instructions how 

you want this done, etc. and we will set it up. 

Can you provide us some info on the function of th< ____ 
different configuration DCS3000 to handle the overseas 
Any backgroun info is appreciated! |is not herean< 



was labeled DCS3000. Is this a 
could we not use the existing DCS3000? h2 

he 

lb 7 C 
b7E 


ind I are putting this together. 


W I OLAGO I W SD 


-H HOLAOG I H EP- 




From: 

Sent: 

To: 

Subject: 


>SAt (FBI) 

Maadaa luliUfl 2QQ£ 4:54 PM 
I - - ~ k OTD) (FBI) 

McAllenl Icircuit DCS 3000 


U N 0LA 66 ir iEB 

NON-RECORD 


I h ot the provider to check the circuit. Now his j 
tried to ping the router without success. What should we do next? 


Rights 


are out, but the system is still not working. I 


b2 


saL- 

21 ol 



be 

b7C 

b7E 


[ 


|OTD) (FBI) 


From: 

Sent: 

To: 

Subject: 


| HO) (FBI) 

i»ii » in mo p 2:33 PM 
I (OTD) (FBI) 
Question re target record 


lb 6 
b7C 


NON-RECORD 


] 


I'm the ! I n Houston and I work the the Tech Agents. I checked with them about an 

uniignal tamftt rp.r.nrri nngstinn hut thow tm ara nu77icri | raraiwarl an arrnr record on 7/2/06, for target number 
I 1 1 checked I I but this number isn't entered as a target 

number. I checked th d I machine l l and the DCS 3000 (criminal) but this number hasn't been entered there 

either. How did we come up with this number? I haven’t collected anything on this number since then, so do I just ignore 
this happened? Or, should something like this be reported? 


Thanks for your time! 


tC 

HolusI 

713|_ 


□ 

] 


b2 

b6 

b7C 

Io7E 


SENSIT I VE B U T U MCEAft SI F tSB 


96 


^SEetCT 



%G HFf 


"kOTDHFBI) 


w 

he 

b7g 


From: 

Sent: 

To: 

Cc: 

Subject: 



IMPLEMEN I ING MEn register with 


UHGLAOOl PtgQ - b2 

NON-RECORD bs 

fo7C 

b7E 

Hi I — I - We have a court order that cover s | | How do we 

implement the pen register in DCS 3000 with | | 

| |. Line was alr eady set up in DCS 3000. 1 | and I 

tried to set up the line t ol I client, but we are getting 

message: Target not s ent to |_ | Server (Reason: Not authorized) . 

I called and advised | ( that we are not receiving 

data since the line was provisioned on July 3, 2006. 

| | advised there have been activ ity f rom July 3 thru 

todays date. If we don't set up the line to | [ server would 
that reflect of not receiving data? 


FBI -WPO/Smia.Tff T 

M I 


b6 

fo7C 


From: 

Sent: 

To: 

Subject: 


](OTD) (FBI) 


^ Thursday July 06. 2 

‘ DCS3000 


lSF) (FBI) 
[06 2:27 PM 
jOTD) (FBI) 


NON-RECORD 


bs 

b7C 


bl 

"CD 

Eve| 7 day the DCS300C 
j rJ i. device type from the c 

i “ r they reappear later. I've tried a reboot of the system, but the message keeps coming back. Can you take a look when 
you get a chance or give me a call to explain what it's trying to open? 


f~ l e 

iven filename extet 


:eeps opening up a error box with the message "Client - Cannot determine the 
:nsion". it will some times be displayed 20 times. I dose all the messages and 


97 






I'm in the process of trying to get a new motherboard, processor, and RAM to upgrade the DCS here. Whenever ! 
tries to burn copies of large end of pen reports to CD, the DCS says it's running out of memory and crashes. Is this the 
correct direction to go? It doesn't happen if they’re smaJI files. 


] 


The case agent inquiring about the 800 no. pen never got back to me, so I don't know what the status is. 


Let me know what I need to do. Thanks. 


dH 



](OTD) (FBI) 


From: 

Sent: 


Cc: 

Subject: 


I I nk) (fbi) 

Thursday, July 06, 2006 1 1 :32 AM 
■ ‘'OTD) (FBI) 


INK) (FBH 
■ Re: DdS 4o6o Computer. 


55 


uNGLA s e i n ee 

NON-RECORD 


IZZ1 

I don't know if you remember speaking to us or not regarding replacing our "front room" DCS 3000 machine. The one we 
are using now is attached to the CDNRS machine. We what to remove it from the CNDRS and start having the lAs 
downloading from the DCS 3000 instead of the CDNRS. The problem with the old machine is that it does not have a CD 
burner. Is it possible to send us a new DCS 3000 computer? Thanks. 




l 

From: 

Sent: 

To: 

Cc: 

Subject: 


~ 1 (OTD) (FBI) 


(FBlC 

RE: DCS 3000 modem 


|(OTD) (FBI) 

3 WBBTg-S H am 
VF) fFBDl 

iHEBM 


ZIl(OTD) (FBJ1 
□(WF) (FBI)CZ 


](WF) 


NON-RECORD 


□ 


eason the come 


I s the nui 
• reason the connection tc 
connection. 


modem a i ~~l The modem at this locatio n is not answering, which is the 

is down. We (WFO) need to contac t | to seek assistance in restoring the 


2E£Z 
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:RET 


— OriginaLM 

From: I 

Sent; 


JWF) (FBI) 

2256 9:23 PM _ 
,OTD) (FBI)I 
) (FBI); | 


TWf 


"TWFOTf 


](WF) (FB1);Q 


3wF) (FBI) 


NON-RECORD 


b7E 


Some of this information is third hand so it might be a little distorted. 

This is what I w as < < ■ 

I I contacte d | stating a line was running open | l stated it was for i I 

tracked it to a modem that was not working properly. The modem is dialing out, can” connect, hanging up and 
redialing. This has been occurring for a week now. 

This is my research: < 

j i linker! at j^js modem. It is modem number # 6. It is connected to port# 5 on the I S eries machine with I I 

According to our records Norfolk was calling this modem to connect to the DCS 3000 system. If this has changed then 

I am not aware of this. | I 

Based on the above I looked into the multiserver and could not find a switch fori bn the l I 

machine. ■ ■ ■ 1 1 b.l 

I looked on the j | multiserver and found thel Iswitch but it was not checked. b2 

1 hooked a l I to the modem and determined the number being dialed is 202 | E Do you know b7c 

what this is?? I don't. b 7 e 

I searched this in our database and came up with nothing which probably means that we did not order this line. 

Can you look into this and determine what this modem was being used for? Is it still needed? Can we power it off?? 

for your help. 

he 

hlC 


wet-Aooir i E B- 
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be 

b?c 



Some of this information is third hand so it might be a little distorted. 


This is what I w as told: ____ 

I I contacte d ~| stating a line was running open I j stated it was for i I 

tracked it to a modem that was not working properly The modem is dialing out, can't connect, hanging up and redialing. 
This has been occurring for a week now. 


This is my research: _ 

I looked at this modem. It is modem number # 6. It is connected to port# 5 on tha 


s machine with ! j 


According to our records Norfolk was calling this modem to connect to the DCS 3000 system. If this has changed then I 
am not aware of this. . . 

, Based on the ahau&JJaoksdinto the multiserver and could not find a switch fo | p n the| [machine. 

J I looked on theT Imultiserver and found the Allegiance switch but it was rW>t checked. 


| multiserver and found the Allegiance switch but it was 
> the modem and determined the number being dialed is 20;f 


I hooked al I to the modem and determined the number being dialed is 20 3 l <— Do you know what 

this is?? I don't. 

I searched this in our database and came up with nothing which probably means that we did not order this line. 

Can you look into this and determine what this modem was being used for? Is it still needed? Can we power it off?? 



1 oo 


JWF) (FBI) 

DD6 9:23PM . 
_J(OTD) (FBI)I 


Some of this information is third hand so it might be a little distorted. 

This is what I w as told^ — — . 

I Icontacteq |stating a line was running open. l s tated it was fo| | 

tracKea it to a modem that was not working properly. The modem is dialing out, can't connect, hanging up and redialing. 
This has been occurring for a week now. 

This is my research: . ■ 

I looked at th is modem. It is modem number # 6. It is connected to port# 5 on thq Iseries machine with| | 


According to our records Norfolk was calling this modem to connect to the DCS 3000 system. If this has changed then I 

am not aware of this. . . . 

( 3 ) Based on the above I looked into the multiserver and could not find a switch fo| |on th^ |nachine. 

I lookecf on the [ I multiserver and found th ^ [ switch but it was not checked. 

I hooked a| |o the modem and determined the number beina dialed is 202| l <— Do you know what 

this is?? i 1 

I searched this in our database and came up with nothing which probably means that we did not order this line. 

bl 

Can you look into this and determine what this modem was being used for? Is it still needed? Can we power it off?? ,b2 
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J(OTD) (FBI) 
]D6 3:09 PM 
JOTD) (CON) 


Attached is wha|_ 
will bring over. 


Original Mess 

From: 

Sent: 


bent us a while ago on his save procedures. I have a hard copy of mine that I 


Tfiere is a DCS Backup directory that is a copy of everything you saved. Are you deleting that too? I have attached 
some thoughts ■ 

on this issue tha l I wrote up. Each office seems to have a different view on how to handle the saves. 

Read this over and 

let me know if it helps. We are still working on incorporating some o j | requests. it is a slow process. 


Pen Register 
Evidence.doc (47 .. 


— Original Message^; 

From: | 

Sent: luesday. 


I just wanted to check with you to see if we're following the correct procedure when making an Original Disk for the 
Case Agent. 

We've been making a Disk from t he DCS 3000 with the CDNRS, Summary and Log files and marking it as Evidence, 
and sending it to the Case Agent, djias then been having us delete it from the DCS to help clean out the system. 

My question is Should we be deleting the records totally from the DCS? Are we supposed to make a hard copy as 

well upon end of the case? Are we handling this the same as the other offices? 

We have an issue that came up today, that the Case Agent say's one of his Evidence Disks is corrupt and he wants us 
to provide him with another Original. Well, needless to say it's gone. 



al 


□ (CG) (CON) 


Wednesday, June 14 . 2006 U:36 AM 


Drawing ror Uiica< 


3‘ 0 


NON-RECORD 


j" | Here is the drawing for our Annex DCS3000 connectivity. 

dcs.vsd (236 KB) 


be 

b7C 


Thanks, 


I n Chicago 

elsuk l echnoiogy Management Unit (ETMU) 
Ele ctronic Surv eillance Technology Section, OTD 
3121 (Desk) 

3l3 Cell) 


-SEGRPT' 
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NON-RECORD b7c 


□ r 

Looking at getting the GR-30 solution for the pen's frorrl land then d Ifor the audio. What do we 

need for our DCS 3000? 1 1 1 1 

We want to do a test with th ^ | | How do we go about doing it? Does thd Ifor the data need to 

be groomed to a specific specification? 1 1 


sa[ 


Tech Advisor 



h'Z 

b7E 


S E N S I T I VE ' 


From: 

Sent: 

To: 

Cc: 

Subject: 


UHGLAGG I P tEB 


l(OTD) (FBI) 


3(OTDMFBI) 


£ 


L 


' ioio) (mu 

CAIEA Numbers 


uae 22, 2006 3:35 PM 
IkQip) (FBI) ■— 

I tOTP) (FBDf 


b6 

h7C 


](OTD)(FBI)C 


] 


OCORe F f /NOFORN b6 

RECORD 31S b7C 


I 1 

Here are the CALEA numbers for 2006. There are multiple ways to present the information. The two I chose are: 1) new 
lines added in CY 2006, and 2) lines intercepted in CY 2006. 

New Lines Added in CY 2006 


h2 

b7E 


Lines Intercepted in CY 2006 


■SEeKEf 




Note these numbers are for CALEA-enabled intercepts supported by the DCS-3000 system. Thellumbers will 
comletely overlap with the DCS-5000 numbers, and a portion of the criminal numbers will overlap with the DCS-6000 
numbers. 

to 6 
b7C 


□ 



be 

b'7C 


kt: ucs systems 


l(OTD) (FBI) 

•* onnc 9 42 am 

(SecD) (CON) 


NON-RECORD 


be 

b7C 


n 


Attached is an one of our router scripts. | 

addresses are 1 

still in it though so we consider it sensitive. Sorry for the delay in getting it out. It’s been busy. 


^pulled it and removed password specific info. The IP 


[ 


dcsn_erf-confg.txt 
—I (7 KB) 


— Original Message--— 

From: I 

Sent: Monday. June 17. 

To: f 

Subject: Kt: dcs systems 


h ecD) (CON) 
106 12:47 PM 
(OTD) (FBI) 


fc>6 

b7C 


NON-RECORD 


b2 

b7E 


202t 


! t. Looking forward to working with you guys again, 
scanner you should have a good idea how it works, 
determine patch levels for on the windows. 


] 


— Ori ginal Message — 

From: I tOTD) (FBI) b6 

Sent: Monday. June 15. 31)06 9:5 0 AM b^C 

To: | | (SecD) (CON) 

Subjects REITZS "SySfSWS 1 


Now that you have had a chance to see the . 

Perhaps we could configure it not to port scan. I I 


SE N SITIVE BUT UNOLAGS i r i CP 
NON-RECORD 
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a 


is on travel last week at a conference. 


together early this week |— 
and send to you. I will ask| 
system. I should be 
here all week except Friday. 




Sorry for not getting back to you sooner. I will get some scripts 
ISSO for DCS3000 when he is available for a scan of a DCS3000 


□ 


Original 

From: I K Sec PI (CON) 

Sw it-: Mnnri av limp 05. 70flfi Q'fl7 AM 

To: form (FBI) 

Cc: Ig ecD) (CON) 


NON-RECORD 


fee 

b7C 


^ i need some sample configs from your routers (with the community strings, passwords etc stripped). Also, if 
you have an updated network diagram please send that as well. 

I would like to scan a DCS3000 system, if only to ascertain the possible consequences of scanning DCS3000 
network. Do you have a system ready to go? This will probably be the last time ESOC will assist in FISMA 
compliance testing. After this, the ISSO's will be responsible for annual scans of systems. 


Thanks 



] 


be 

b7C 


U N CLA SS IF tEP 


UHG t ASS I R SP- 


BU TUMG L ASS I P ISP 
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To: f 

Subject! Nj. M tDt 


lb 2 
fo7E 


^CFfT 

J(OTD) (FBI) 


NON-RECORD b c 

«□ 

If you've done something thanks, otherwise disregard. It appears I was getting no pen on one line, but the other 
four have pen from 5/5/06. 


But, not to l et mu get off too fast. Where do I go to get some info to do a pen on an 800 number that rides on a 
hardline of | f 


Subject: 9.6 CDC 


b6 

b7C 


lb 2 
be 


b7E 


NO jj ffECORD b6 

fo7C 

H' l I 

I've attached ph otos of our rack holding the DCS3000 ro uter a nd routers used for the mllerti nn nf the rnr from 
I j eliverv. When you initially set it up with | | ports 1 and 3 were used on the | | 

Currently ! N send ‘ n 9 another target from another switch on port 2, which we're not getting anything on. 

On the back of the l l are si) ! bards that have 4 por ts each, ie., x.l, x.2, x.3, and x.4. Port 1 

of the firs t card is plugged into on e of the two ! *1 Por t 3 of the first card is plugged into one 

ofthetwol l . These appear to be working fine. I « l 1 » « F ile: 

I l» << File ! t » mistak enly th ought that for every different switch we were g etting thl I 

cine trnirTwp would need a separate router ] p ointed out that it would only need a new port. I I 

1 | says all is functioning properly on their end for se nding the CDC on the new target, on port 2. Port 2 

is currently p lugged into the othe l b n router I I Is there further configuration needed on our end for 

| j port 2 to collect the CDC? 1 1 

I tried plugging port 2 from the | ~jn the new router y ou sent! I bu t didn't collect anything. Any 

enlightenment you can provide will be greatly appreciated. | i tjzu l 1 Thanks! 


no . 


- SECRE ' f 



[ 


it is l I Let me know if you want me to be in on any calls with them. It is a learning experience on some of these 
applications 
of CALEA to hardlines. 

foe 

fo7C 


fo2 

foe 

fo7C 

fo7E 


- — Original Mpccanp — 

From: r I SF) (FBI) 

Sent: Tuesday, June 20. 20 06 2:10 PM 

To: I K OTO) (FBI) 

Subject: FW: 9.6 CDC 


NON-RECORD 


foe 

!fo7C 


Hi [ I 

If you've done something thanks, otherwise disregard. It appears I was getting no pen on one line, but the other four 
have pen from 5/5/06. 


But, not to let vou g et off too fast. Where do I go to get some info to do a pen on an 800 number that rides on a 
hardline o j "] 


— -Original 1 

From: 


l(SF) (FBI) 

Sent: 


5 19. 2006 12:30 PM 

To: 

| ' 

IfOTD) fFBD 

Cc: 


ISF) (FBI) 

Subject: 

9.6 CDC 


NON-RECORD 

fo6 



fo7C 


H' l I 


I've a ttache d photos of our rack holding the DCS30 00 rou ter and routers used for the co llection of the CDC f rom | ] 
via the l faeliv erv. When you initially set it up with I I ports 1 and 3 were used on th j I 

Currently! Is sending another target from another switch on port 2, which we're not getting anything on. 

On the back of the | I re six ! bards that have 4 p orts each, ie., x.l, x.2, x.3, and x.4. Port 1 of 

the first card is plugged into one of the two | ~j Port 3 of the first card is plugged into one of the 


in 




two | | These appear to be working fine. I << File i h > << Fite I I 

>> « File i " E > mist akenly thought that for even/ different switch we wpp» netting the! hnr. from, we 

would need a separate router. l b ointed out that it would only need a new port i I says all is 

functioni ng properly on their end f or sending the CDC on the new target, on port 2. Port 2 is current ly plugged into 
the other ! I Is there further configuration needed on our end for router ] f ort 2 to collect 


iut didn't collect anything. Any 
"1 Thanks! 


I tried plugging port 2 from the ! i n the new router yousentl— 
enlightenment you can provide will be greatly appreciated. | | 925| 



Attached is the DR AFT DC S-tnnn lo EDMS interface meeting notes. Would attendees please review for errors and 
omissions? Woulc] pnd[ |be the action item assignees for scheduling the next meeting ? 



DCS-3000_EDMS_I 
nterface.doc (3... 



OT DFSTSFTM U 
703 ! I New!!) 
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• 

foe 


|0TD) (FBI) 



From: | 

l(OTD) (FBI) 



Sent: 

Mondav. June 19. 2006 4:17 PM 



To: 

i I(otdwconH 

rAf d\ Icon) 


” l(OTD)(CON);| | 

Cc: j 

IIOTDXCON1 F 


](OTD) (FBI)| 1 


IOTD) (FBI)l 

J(OTD) (FBI)C 

KOTD) (FBI) 

Subject: 

DEMOS Thursday (6/22) 




NON-RECORD 


All, 

You're invited to attend a short demo with the following groups this Thursday (6/22): 


1) 0900 - DCS-6000 Lab, 

2) 0930 - Traditional Lab. I I , rD6 

31 1 000 - CROC Hein D esk Center I I blC 

4) 1030 - DCS-3000 Lab | | 

5) High Capacity Lab, | [ next week TBD 


Thnx, 

-ca 


TYERYAR, KEITH A. (OTP) (FBI) 


From: 

Sent: 

To: 

Subject: 


I |WF) (FBI) 

■hriday, June Id, 

IfOTD) (FBI) 
RE: CDklftS Pile format 


foe 

b7C 


UNCLA S 6I H6Q. 

NON-RECORD 


Thanks againjj 


— Original 

From: 

Sent: 

To: 

Subject: 


TONUS htfWrtfflT" 


JOTD) (FBI) 
?006 4:41 PM 
JWF) (FBI) 


be 

b7C 


NON : RE , C ORD 


EHached are the field definitions for the DCS 3000 CDNRS file, 
j | « File: DCSPC.txt » 
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seettrr" 





From: 

Sent: 

To: 

Subject: 


UNCLAGGiriCP 

NON-RECORD 


lb 6 


— Original Message 

From; I I CE) (FBI) 

Sent: Tuesday, January Z4. 2006 4:50 PM 

To: I "I f OTP) (FBI) 

Subject: RE: DCS 3000 issues 

U NC I ftffB i nCD — 

NON-RECORD 


114 




-SEeftET 




Q could you write up a little something about your case last week and how the DCS3000 and th d Ip roqrams 
ed for you (good or bad). This is low priority and can be done when you have a moment. 


Thanks... 




115 


.SEeftFT 




..huh, what??? (kidding....) 

Here ya go! Please see the conclusion portion of the l H doc. that mentions the 
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DCF3000 DCS-3000 ATO EC 

POAM.doc (128 KB) 06012006. wpd (... 


be 
fo7C 

i ssivn 

PSEC, MCSE 

1 9, room 9-LL-14 i i 

..."lead, follow, or get out of the way." I I 

- — Original M — 

From: 1 I f OTP 1 (FBI) 

Sent: -i, ,n 0 ~RT onnc 9;2 3 am 

To: | |SecD)(CON) 

Subject: Request email copy of DCS3000 ATO 


Quantlco Complex 
CISM , CISSP. IS S. 
<70311 Bit 


NON-RECOR^ b6 

b7C 


!=□ 

Could you email me a copy of the DCS 3000 ATO so I could review it 
Thanks 


■B UT UH0LA6 6t nCP 


CH 

From: 

Sent: 

To: 

Subject: 


1 (OTP) (FBI) 


[ 


RE: Dcs systems 


|( SecD) (CON) 
2U0B XIAt PM 
_J(OTD) (FBI) 


NON-RECORD 


Sounds great. Looking forward to working with you guys again. Now that you have had a chance tc 
scanner you should have a good idea how it works. Perhaps we could configure it not to port scan p 
mine patch levels for on the windows. 


OTD) (FBI) 

B iO AM 
(SecD) (CON) 
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.SFRBFX 


foe 

lb 7 C 



NON-RECORD 


I i wal o 


I on travel last week at a conference. Sorry for not getting back to you sooner. I will get some scripts together 
early this week I 

and send to you. I will ask| |the ISSO for DCS3000 when he is available for a scan of a DCS3000 

system. I should be 


here all week except Friday. 

] 


fob 

fo7C 


•Original Message--- 




Subject: Dcs systems 


JfOTD) (FBI) 
J(SecD) (CON) 


SEMSITIVfe-Btf 

NON-RECORD 


I need some sample configs from your routers (with the community strings, passwords etc stripped). Also, if you 
have an updated network diagram please send that as well. 

I would like to scan a DCS3000 system, if only to ascertain the possible consequences of scanning DCS3000 
network. Do you have a system ready to go? This will probably be the last time ESOC will assist in FISM A 
compliance testing. After this, the ISSO's will be responsible for annual scans of systems. 

Thanks 


S E NS I T I V E BU T U NCLA S S I FIED 
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From: I l (OTD) (FBI) 

Sent: Monday. June 12 2006 9:50 AM 

To: I I (Seem (CON) 

Subject: RE: Dcs systems 


NON-RECORD 


I was on travel last week at a conference. Sorry for not getting back to you sooner. ! will get some scripts together 
early this week 

and send to you. I will ask | I the ISSO for DCS3000 when he is available for a scan of a DCS3000 system. I 

should be 

here all week except Friday. 


OU 


Subject: Dcs systems 


(FBI) 

(CON) 


SENSITIVE BUT UNCLASSIFIED 

NON-RECORD 


I need some sample configs from your routers (with the community strings, passwords etc stripped). Also, if you have 
an updated network diagram please send that as well 


I would like to scan a DCS3000 system, if only to ascertain the possible consequences of scanning DCS3000 network. 
Do you have a system ready to go? This will probably be the last time ESOC will assist in FISMA compliance testing. 
After this, the ISSO's will be responsible for annual scans of systems. 


Thanks 

lest team' 

2 °t _ — ] 
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- sce Rer 




NON-RECORD 


b7C 
b 7 E 

IZZI 

As you are probably aware, the l b vstems around the Bu are being isolated in SCIFs per Security Div. 

require ments. He re in KC we placed the T III voicebox system in the former FISA room, (no windows) and the SCIF 
with the l ~| is now in the big room with windows which is acceptable to SecD for a SCIF. I can't figure that one 
out but they don't pay me to think about these things. Our SCIF has not been officially closed off yet but will be soon, 
and the criminal Agents, analysts, etc may not have access to it depending on their clearance level They do need 
access to the 3000 from time to time. 

Question, are we planning to have two DCS 3000 in each office to separate the FISA from the criminal? I am sure 
that will be an issue soon. 


Thanks, b6 

I 1 



-SECRET 


From: 

Sent: 

To: 

Cc: 

Subject: 


ITD) (FBI) 
10:44 AM 
|(OTD) (FBI) 
kOTD) (FBI) 


\-W. urgsm ^USSMJAG short-fused PIA tasking 


NON-RECORD 


FYI... thanks for handling for 3000. . 

Supervisory speed Agent 

DCS Program Manager 
OT D/ESTS/TIC TU 
703| Iwj 

2V\ fc) 


be 

b7C 


Messaflte 




~~JOTD) (FBI) 
2006 9:5 6 AM 

iPipiirenP" 


iOTDlfFBnl ' IOTP) (F BI); CLIFFO RD. MICHAEL (O TD) (FBI] 

3GA II I SecPKCGNlf ZJOTD) (FBI] I KOTD] (FE 

=BI); T TCTO) (FBI)J |(OTD) (FBI)i ((OTI 

M> om L. (umj [r-h ] 1 1 1 1 


(OTD) (FBI);| IT 

THOMAS, MMZrrmWBl. 

RE: Urgent request-DAG short-fused PIA tasking 


JOTD) (FBI) 


NON-RECORD 


All, 

Upon completion of your PIA and it's approval by you SC, please forward me an electronic copy no later than 10:00 AM 
Friday. 6/9/06. 1 will then forward OTD's submission to OGC by COB Friday. 6/9/06 in order to meet the OGC’s deadline 
of "NLT Friday. 6/9/06." Please ensure that the descriptions of your system are written in such a way as to ensure that a 
reader with no knowledge of what your unit and/or what OTD does can clearly understands, based solely on your 
description, what your system's purpose is and/or what it does. 


In addition, our next deadline is Wednesday, 6/21 regarding the PIA short form for your system. Upon completion of your 
PIA and it's approval by your SC, please forward me an electronic copy no later than COB Tuesday. 6/20. I will forward 
OTD's submission to OGC by COB. Wednesday. 6/21 in order to meet OGC’s deadline of "NLT Wednesday, 6/21. 


Thanks for your assistance regarding these short deadline matters. 


□ 


[ 


Assistant Section Chief 
Technical Programs Section 
Oper ational Techn nlnny Division 
(70311 I 


lb 6 
b7C 


Original Message 

From: I _[OTD) (FBI) 

Sent: Monday, June Ob, il)06 4:52 PM 


121 


£ _Si6Rei — # 

Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 

Desired location i j | RAwith | B A as a second possible location. 

Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring circuits if E 
desired. 

! beli eve that vnu informed me that Chicago does not have a circuit to the ! R A at this time but may still have one 
for th l R A. 

I was also informed that Chicago would pay for the circuit to each location. The desired circuit for each would be a full 
T1. 

You had mentioned that the circuits would be temporary and only for the operation of the specified case that the office 
will work. With the remote setup the circuit would need to remain up as long as case review was needed at the RA or 
the case could be processed at the Chicago FO once monitoring was over and a circuit discontinued. 

Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine with 
CDR capability and a printer. 


Looking forward to your response. 


* Desk- 7 03[ 
Cell - 202|" 


be 

b7C 


WGLAGGin fcP- 


| [OTP) (FBI) 


From: 

Sent: 

To: 

Cc: 

Subject: 


>) (CON) 


KOTO! (FBI) 
tSecD) (COI 


be 

b7C 


OC N O I T I VC PUT UNOLAOa tHeD be 
NON-RECORD fo7C 


□ 

I need sc 


I need some sample configs from your routers (with the community strings, passwords etc stripped). Also, if you have an 
updated network diagram please send that as well. 


I would like to scan a DCS3000 system, if only to ascertain the possible consequences of scanning DCS3000 network. Do 
you have a system ready to go? This will probably be the last time ESOC will assist in FISMA compliance testing. After 
this, the ISSO’s will be responsible for annual scans of systems. 


Thanks 

202 \ | 


be 

b7C 


125 







Just wanted to take a moment and sincerely thank you guys for everything you do to assist us. 

The recent DCS 3000 solution you provided that allowed us to get pen data to ou | lo cation and into the f 9 

VoiceBox system has been invaluable. Instead of providing pen data for what was JxpsCKJH lb be a short period of a few °i w 
days, it continued to p rovide data to our Title Ills for two weeks. The restore process failed when attempting to import data D ' a 
from the old version a(_____Jnto the new version at the CMP. The problem was solved last week, but your equipment 
allowed us to have a mangeable problem instead of a major headache 

I hope we provide the kind of support to those we assist that you provide to us. 

Thanks again, 

From all of us at the New York CMP 



p would prefer just one machine but I am sure SecDiv at some point is going to force this on us anyway, 
ir email so we can discuss, I am guessing we will need a second circuit to St. Louis? 


As an aside, the SCIF thing is getting out of control in the field. Three Squads a 


flashing red lights when a non SCIF'd person ent ers, inc 
flashing red lig hts were on all day. Also when our f 
P IBAE man will not be able to get to his aest 


n SCIFs and they have to turn on 


g Agents and other FBI folks. I was told that the other dav the 
area is officially blessed and activated as a SCIF, | | 

ey pulled his SCI clearance when he retired and now trying to 


I 
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£ -eeeRET" 0 


get them renewed. Is SecDiv doing things like this back there? 


— Original 

from: 

Sent: 

To: 

Cc: 

Subject: 




Friday. June 02, 2006 1:33 PM 


3 KC ) (FBI) 

T5tD) ( 


RE: DCS 3000 


6ENG I TIVC BUT UHChASS I P lEP 
NON-RECORD 


to 6 
fo7C 


CD 


Yesf we can provide a separate system for each. This is a preferred way for us in some respects. It means twice 
many i i 

upgrade and keep track of but, it allows for isolation of the targets for trouble shooting and the like. I J 


is our deployment coordinator for the group. If you can give him a call or e-mail he can work out what kind of 
machines to send 


□ 


be 

b7C 



] (Kg (FBI) 


NON-RECORD 


As you are probably aware, the] Systems around the Bu are being isolated in SCIFs per Security 
Div. requirement s Here in KC we placed tne i m voicebox system in the former FISA room, (no windows) and 
the SCIF with th<£_~__Jis now in the big room with windows which is acceptable to SecD for a SCIF. I can’t 
figure that one out but they don't pay me to think about these things. Our SCIF has not been officially closed off 
yet but will be soon, and the criminal Agents, analysts, etc may not have access to it depending on their clearance 
level. They do need access to the 3000 from time to time. 

Question; are we planning to have two DCS 3000 in each office to separate the FISA from the criminal? I am 
sure that will be an issue soon. 


Thanks, 

□ 


be 

fo7C 
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.SECRET 


From: 

1 

loTD) (FBI) h * c 

Sent: 


2E2.33 PM 

To: 

f m 

—□(KC) (FBI) 

Cc: 


liOTPi (FBI) 

Subject: 

RE: DCS 3000 




Yes, we can provide a separate system for each. This is a preferred way for us in some respects. It means twice as 
many ■ ■ 

machines i n upgrade and keep track of but, it allows for isolation of the targets for trouble shooting and the like. I fl 

isouj | for the group. If you can give him a call or e-mail he can work out what kind of machines to 





As you are probably aware, the j "T systems around the Bu are being isolated in SCIFs per Security Div. 
require ments. Her e in KC we placed the T III voicebox system in the former FISA room, (no windows) and the SCIF 
with the ! | s now in the big room with windows which is acceptable to SecD for a SCIF. 1 can't figure that one 

out but tney don't pay me to think about these things. Our SCIF has not been officially closed off yet but will be soon, 
and the criminal Agents, analysts, etc may not have access to it depending on their clearance level. They do need 
access to the 3000 from time to time. 

Question; are we planning to have two DCS 3000 in each office to separate the FISA from the criminal? I am sure 
that will be an issue soon. 


Thanks, ]b7c 

□ 












-fteFtCT 



KC) (FBI) 

JE AM . 
J(OTD) (FBnf 
J(KC) (FBI){_ 


As you are probably aware, the l I svstems around the Bu are being isolated in SCIFs per Security Div. 

re quirements Here in KC we placed the T 111 voicebox system in the former FISA room, (no windows) and the SCIF with 
th a I is now in the big room with windows which is acceptable to SecD for a SCIF. I can't figure that one out but 

they don't pay me to think about these things. Our SCIF has not been officially closed off yet but will be soon, and the 
criminal Agents, analysts, etc may not have access to it depending on their clearance level. They do need access to the 
3000 from time to time. 


Question; are we planning to have two DCS 3000 in each office to separate the FISA from the criminal? I am sure that 
will be an issue soon. 



I I here is what 1 have so far for Chicago to be a test site for remote ! j we will need to move quickly for 

completion by the date we discussed earlier. 


Discussed installation date ol 


squipment and initial test. Begin on Monday July 10th. 


RA with | p A as a second possible Ic 


Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring circuits if 
desired. - 

I h elifiva that y ou informed me that Chicago does not have a circuit to the ! | RA at this time but may still have one for 


was also informed that Chicago would pay for the circuit to each location. The desired circuit for each would be a full T1 . 






SECR H- 


You had mentioned that the circuits would be temporary and only for the operation of the specified case that the office will 
work. With the remote setup the circuit would need to remain up as long as case review was needed at the RA or the case 
could be processed at the Chicago FO once monitoring was over and a circuit discontinued. 

Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine with CDR 
capability and a printer. 

Looking 


Desk- 7Q3[ 
Cell - 202L 


ard to your response. be 

h 7 C 




From: 

Sent: 

To: 

Subject: 


J(OTD) (FBI) 

| |[OTD) (FBI) 

Friday.' May!?BT5DUg ^:41 PM 
IZ___IJWF) (FBI) 
FW: Missing Pen Register Data 


S E NS I T I V E BUT UHGLAGQ i r i CD 
NON-RECORD 


1=5, 

□ 


ID should be the target number and 


— Original Mp^ ne 

From: | |(OTD) (FBI) 

Sent: Vridiv. May A. JUlft 5:28 PM 

To: I | WF) (FBI) 

Subject: RE: Missing Pen Register Data 


□ 


be 

fe7C 


NON-RECORD 


DJ, 

There is some data. The last four laters on the caseid should be 


□ 


n 


— Original 

From: 

Sent: 

To: 

Subject: 


Missing Pen Register Data 


](OTD) (FBI) 


ocno i t i vc but unglao s if i ed 
NON-RECORD 


|could you please check the following number in DCS 3000. We are not getting Pen Register data. We've 

done correctly on their end. They advised 

L 1 *><* 

t//c 


'eked with the phone co. to make sure that ev 
us to contact you all. Thanks!! OhM! The number is 202 
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From: 

Sent: 

To: 

Subject: 


ffeeRET** 


JOTP) (FBI) 


L 


Missing Pen Register Data 


IJWF) (FBI) 
22.2006 2:39 PU- 
](OTD) (FBi)^_ 


]0TD) (FBI) 


SENSITIVE BUT UNC L ASSIFIED 

NON-RECORD 


I l ;ould you please check the following number in DCS 3000. We are not getting Pen Register data. We've 

double checked with the phone co. to make sure that evsrvthinn has been done correctly on their end. They advised us to 
contact you all. Thanks!! Oh ! ! ! The number is 202 | | 


E 


202 


Desk) 

202 


Cell) 

202 


Pager) 


IZZ 

From: 

Sent: 

To: 

Subject: 


-W ICLAS6 I F IEP- 


~I(otd) 


(FBI) 


□(SF) (FBI) 


, Tuesday, May 23, 2906 3:50 pm 
I J (QTD) (FBI) 

RE: Pen Data 


bG 

Jb7C 


NON-RECORD 


Thanks. ..I'll let you know. 


r 1 


Ext 

r 

925 




fos 

b7C 


:OTD) (FBI) 
i06 10:37 AM 
[SF) (FBI) 


NON-RECORD 




mere is a DCS Backup directory that is a copy of everything you saved. Are you deleting that too? I have 
attached some thoughts 

on this issue that Twrote up. Each office seems to have a different view on how to handle the saves. 


Read this over and 
let me know if it helps. We are still working on incorporating some of 


jequests. It is a slow process. 





0 — SEeRFT 


□ 

« File: Pen Register Evidence.doc » 



I just wanted to check with you to see if we're following the correct procedure when making an Original Disk for the 
Case Agent. 

We've been making a Disk from the DCsan nn with the CDNRS, Summary and Log files and marking it as 
Evidence, and sending it to the Case Agent. las then been having us delete it from the DCS to help clean 
out the system. * * 

My question is Should we be deleting the records totally from the DCS? Are we supposed to make a hard copy 

as well upon end of the case? Are we handling this the same as the other offices? 

We have an issue that came up today, that the Case Agent say's one of his Evidence Disks is corrupt and he 
wants us to provide him with another Original. Weil, needless to say it's gone. 


Any help would be appreciated 





- S CC R PF 


From: I I (OTP) (FBI) 

Sent: Tuesday, May 23^2006 1 :37 PM 

To: I l (SF) (FBI) 

Subject: RE: Pen Data 


NON-RECORD 


be 

b7C 




Tie re is a DCS Backup directory that is a copy of everything you saved. Are you deleting that too? I have attached 
some thoughts , _ 

on this issue that ! I wrote up. Each office seems to have a different view on how to handle the saves. 

Read this over and ■ ■ 

let me know if it helps. We are still working on incorporating some ofl requests. It is a slow process. 



Pen Register 
Evidence.doc (47 ... 


foe 

fo7C 


Original Message — 

From: | | SF) (FBI) 

Sent: Tuesday. May H. ?0 06 1:04 PM 

To: I I COTPl (FBI) 

Subject: Pen Data 


NON-RECORD 


foe 

fo7C 



I just wanted to check with you to see if we're following the correct procedure when making an Original Disk for the 
Case Agent. 

We've been making a Disk from t he DC S3000 with the CDNRS, Summary and Log files and marking it as Evidence, 
and sending it to the Case Agent. | | has then been having us delete it from the DCS to help clean out the system. 

My question is Should we be deleting the records totally from the DCS? Are we supposed to make a hard copy as 

well upon end of the case? Are we handling this the same as the other offices? 

We have an issue that came up today, that the Case Agent say's one of his Evidence Disks is corrupt and he wants us 
to provide him with another Original. Well, needless to say it's gone. 


Any help would be appreciated 
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□ 

I just wanted to check with you to see if we're following the correct procedure when making an Original Disk for the Case 
Agent. 

We've been making a Disk fr om the DCS3000 with the CDNRS, Summary and Log files and marking it as Evidence, and 
sending it to the Case Agent. | f ias then been having us delete it from the DCS to help clean out the system. 

My question is Should we BSTJSleting the records totally from the DCS? Are we supposed to make a hard copy as well 

upon end of the case? Are we handling this the same as the other offices? 

We have an issue that came up today, that the Case Agent say's one of his Evidence Disks is corrupt and he wants us to 
provide him with another Original. Well, needless to say it's gone. 


Any help would be appreciated 



■ p w eLAQain ep 

NON-RECORD 

Hello Folks, 

I'm an information systems security representative (ISSR) supporting SD/IAS/ITSU in subject effort. I've been 
tasked to work with you in preparation for an upcoming FISMA inspection due to begin any time after May 
25th. When the exact date of this inspection is announced, either I or one of my teammates will be contacting 
you with same. 

I've been notified that each of you is an ISSO for a particular system (or systems) as shown below: . 
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TICTU would like to purchase) ^Enterprise licenses and need to transfer] 


into your account. 


Should we transfer the funds into the same account as last time? 
Bl) 


CD 


nd the Cost Center is 20 - no 


Thanks, 



NON-RECORD 



VesJ |is the person to work the transfer through. When all is said and done, 

please let me Know and we’ll allocate the licenses to you. 




We are looking to purchase] j= f the Enterprise licenses bringing our transfer to| | We will 

not be able to wait un til after June 15th to purchase them, unfortunately. Do I need to touch base 
witl] jto get the information to transfer the funds? 


This is for DCS3000, which is on the major projects list. 
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1 (OTP) (FBI) 


Jh6 , 

b 7 C 


From: 

Sent: 

To: 

Subject: 


FW: IF^v 6 Request 
High 


□(OTD) (FBI) 
35e 3:08 PM 

_JOTD) (FBI) 



Application 
nventory template.. 

NON-RECORD ' 




i tmrlt the TMD and possibly our web page will fall into this catagory. Look at the template and fill it in if you can. I 
believe it 

is due bv COB t he 16th. I am sending this e-mail so I don't forget tomorrow. The following quote from the e-mail sent by 
F ['These requests pertain to hardware/applications which are part of the backbone (FBINet), connecting 

1 to m i Net, or 1 

connecting to other government agencies that would be impacted by the transition from an IPv4 to IPv6 addressing 
scheme ", lead 

me to believe the DCSNET and DCS3000 are exempt (thank goodness). be 

b7C 



](OTD) (FBI) 


Subject: FW: IPv6 Request 

Importance: High 


NON-RECORD 


To All, 

Seems it has been a while since you have seen this, but please send me your answers no later than COB tomorrow. 
For any positive responses, please use the template; any negative, just respond back to me as so. Thanks. 

| [ please remind me of this task (I do not think it has been completed yet). Thanks. 

I 1 

be 

b7C 


“□(OTD) (FBI) 

Fro) (FBI) 


-—-Original Message-— 

From! I (OTD) (FBI) 

Se nt: Wednesday. Aor7r i2. 2006 8: 54 AM 

To. I _}° Tm (fbi)L_ 

Cc ~ R OTD) (FBI); | 

Subject: FW: IPv6 Request 


JOTD) (FBI)t 


□OTPHFBIJ" 


■SFCRFT 



From: 

Sent: 

To: 

Cc: 


Subject: 


I I mm: (CON) 

Friday. Mav 12. 2006 5 :37 PM 
I IfOTDWFBh 

I I^MMWFRhf 

](Mr 


c 


MU) (P5ij 


MM) (CON)Q 


TfMM) fncmf _ 

| (MM) (FBI);|_ 


NON-RECORD 


foe 

fo7C 



the IP's and our nickname for the DCS3000 machines in the Miami office (this does not include plantation). 
Server (Title III Room) 

Client (Title III Room) 


| [ Title 50 Room) 

T50 (Title 50 Room) - will interface v. 
1 Way Push LO (Title 50 Room) 


ELSUR Technology Management Unit (ETMU) 

Electronic Surveillance Technology Section (ESTS) he 
Op erational T echnology Division (OTD) h'lc 

30d 'l(Desk) 

954 (Cell) 

30S| (Fax) 


lb 2 
fo7E 


^/ia modem 


S C MSmv e- 
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From: 

Sent: 

To: 

Cc: 

Subject: 


3°I°1 


— SE6RET 

IFBI) 


](OTD) (FBI) 


Friday. Mav 12. 2006 1 1 : 1 3 AM 

1| □LT-QdLfbil. 


(6TD) (FBI) 


ITD) (FBI)C 


FW: SBITs Dell Server in Highbay 


foe 

*b7C 


10TD)(C0N); | 1 


UHOLAOQ i ri ee- be 

NON-RECORD b7c 

H *£=□ 

Here is the list of F numbers for the 2003 server licenses. 


1. Names of person(s) that will utilitize these licenses (if known - if systems will be used randomly 
by various personnel, then just state as such). 

Various tech agents in the Field 

2. State whether licenses are for FBI Employee or Contractor use (breakdown the quantities if 
necessary). 

FBI Employee 

3. 


SBITSERVERHIGHB 
AY.xls (18 KB) 

4. State whether computer system(s) is a server, desktop or notebook 
Server 

5. State the enclave, Program and/or network that the system is connected to [such as FBI NET, 
SBUNET (formerly Internet Cafe), SCION, Standalone, etc.), along with the system classification 
Unclass DCSNET 

6. Provide a justification that identifies the business requirements for the software 
DCS-3000 systems 

7. Provide the name of the approving official, title (at FBIHQ, must be Unit Chief or higher; for Field 
Of fices, must be t he SITS or Lead ITS), and the Unit/Section/Division. 

uc l I 



List the Property Number of each computer system that license will be used on. 


- — Original Moc«ng — 

From: I I (OTD) (FBI) 

Sent: TnacHau Maw no ?nnt; U:16 AM 

To: I l OTD) (FBI) 

Subject: fw: SBITs Dell Server in Highbay 

UNCtA69IFIF^ 

NON-RECORD 
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# -seeRET # 

Ves J | is the person to work the transfer through. When alt is said and done, please 

let me know and we'll allocate the licenses to you. 


fc 6 
b7C 


Original Mess age 

From: I | (OTD)(CON) 

Se nt: Thu rsday. May 11. 2006 8:52 AM 

To : i— — iaOD)(FBI) . 

Cc: | | OTD) CFBn l K XIIO) (FBI)r 

Subject: RE! win 2003 server image 

Importance: High 

UHOLAOOIR BD 
NON-RECORD 

fe2 

Io7S 


We are looking to purchase^^if the Enterprise licenses bringing our transfer We will not 

be able to wait until after June 15th to purchase them, unfortunately. Do I need to touch base with 
| | to get the information to transfer the funds? 


](OTD) (FBI) 


This is for DCS3000, which is on the major projects list. 


Thanks, 


OTD/6ST5/TTCTU 

be 

b7C 


(O) 703f 
(F) 703|_ 


— Original Mpto op — 

From: 1 l lTODXFBn 

Sent: 

To: 

Subject: 

■B HOLACCin SO- 
NON-RECORD 



JOTD) (FBI) 


Are you looking for Windows Server standard or enterprise - a nd are those the only 
Microsoft products that you require? To save you some steps - I 1 

I I Note that these costs decrease by 

around lb% or so after June 15 (so if you are deploying after June 15th, you would 
probably want to be paying in our next anniversary cycle of the ELA). 

Also, as a side note, is this project on the FBI’s list of major projects, which is required by 
the CIO and FBI executive management? 


Original M 


Sent: 

To: 

Subject: 




|oTD)(CQN) 
2rt006 3:27 EM_ 
J(OTD) (FBI)f_ 


Kt: wrn ^(JUJ server image 


](ITOD)(FBI) 


NON-RECORD 


he 

b7c 


-seeKET 


UNCLASSIFIED 


1 IOTP) (FBI) 

From: 

1 

|(OTD) (FBI) 

Sent: 

To: 

Cc: 


imS5;23,PM 

f — 

— VfiiLlL 

ROTP) (FBl)l 


uc; i 

Subject: Chicago move 


3 CG) (FBI) 
ITD) (FBI) 


- UNCLASS I F IED- fo6 

NON-RECORD b7C 


He J I 


<S)| 

IS) 


If you decide to move any workstations before you move your servers and routers, then you will need to change the ip 
information in them to get them to work at the new building. You can use the following addresses at the new building as 
snnn as ws net vnur circuit wnrkinq- 

bl 


For your circuits, your main connections seem to be on the£ 

several dial ups or lease line?,. , 

Th 4 h as a | 


J~outer [~ | There is aQ 


Hand 


ThC 


3^ould be moved separately from everything else It would be best if theQ 




connections were moved at the same time as your DCS-3000 servers. 

If vou want to leave machin es at the old building after the servers move, you can give them ips in this range: 
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- SECRET " 


Below are: (1) The section of the EC indicating the systems that need to be represented and (2) the instructions for 
participation in the desktop exercise. 


If any of the systems do not have an ATO or they are unknown, or you are not the appropriate POC, please indicate so in a 
response e-mail. Otherwise, please follow the instructions pertaining to the exercise and post-exercise. 

This exercise should take no longer than 15-30 minutes to complete. The exercise documentation is due to me NLT 12:00 
noon. Tuesday. 10MAY2006 : foi 

fo2 

"Set Lead 25: (Action) b 6 

fo7C 

OPERATIONAL TECHNOLOGY b ,t 


AT QUANTICQ. VA 


Provide the names and phone numbers of the designated representatives ofl 

(S) 

(SE : 


EXERCISE INSTRUCTIONS : 

1 . Review the scenario's (choose the scenario that best applies to your system(s)). (The questions accompanying the 
scenario's are just for you to consider when addressing the scenario - no response to the scenario questions is 
necessary). 

2. Review/refer to the Incident Response Plan (IRP) - SBU-Net and FBI-Net systems: Section 9.4 of your respective IRP; 
CJIS systems: appropriate Section(s) of your IRP. 

3. Fill-in the "Exercise Activity Log" - (the date and time will be the actual date and time you receive this e-mail. The first 
activity block is the scenario. Subsequent entries will address date/time and activities you performed when reacting to the 
scenario). 

4. Fill-in the "FBI Exercise Incident Report" - the date and time will be the actual date and time you receive this e-mail. 
Only fill-in as much information as you need to and are capable to. Not all blocks are expected to be filled-in, although 
they may if you know the information - it's up to you how much detail is provided.) 

5. All Exercise Responses (Incident Reports, Exercise Activity Logs) are due NO LATER THAN 12:00 Noon. Tuesday. 
Mav 10. 2006 . 


POST-EXERCISE INSTRUCTIONS : 

1 . Review Lessons Learned material 

2. Complete Lessons Learned documentation 

3. E-mail Lessons Learned material tc j 

Please contact me via telephone with any questions that you may have, keeping in mind that I am one-deep and there are 
multiple participants. Please retain the I RP. This is a living docume nt, so make any/all adjustments to it, turn "track 
changes" on, and send those changes t d I for configuration management of the master document. 

I will return the updated document to you with the changes. This should become a cyclic process as changes occur. 
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Jno later than 12:00 noon, Mav 10, 2006 . 


— u ECRf rf 



From: 

Sent: 

To: 

Subject: 


l rn _ u|avun/ 

3000 £rror 


1WF) (FBI) 

B; 10:28 PM _ 
□(OTD) (FBI)L 


NON-RECORD 

1=1 


!« g j We are.getting the folJowing error. on one ofour DCS 3000 clients 
I Ws ast auma win<j 9 w ? aUBS n with the following error: | 


What does this mean and what can be done to correct it?? 


I Ttianj^ 


you 


b6 

b7C 
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From: 

Sent: 

To: 

Subject: 


J(KC) (FBI) 
1-Mi AM 


l(OTD) (FBI)|_ 
Trcouters 


T (OTP) (FBI)C 


J(OTD) (FBI) 


□(OTD) (FBI)Q 


XJW LLrtaa i r ta) 

NON-RECORD 

FYI! 


fo2 

fo7E 


This bulletin was brought to our attention yesterday. We didn't know if you guys had seen this back in the lab, so we 
thought we would send it your way. This bulletin refers to counterfeit parts within the routers. 


We have the same 2600 series ! l insta’led for our DCS3000 unit. We have not verified the part 

numbers yet, because it will require us to remove the router from the rack and possible power it down to look inside. Do 
you have any guidance on checking inside the router without taking it down? 


Kansas City 

sis r__\ 



FIN-06-118-Ol.pdf 
(696 KB) 


~|(OTD) (FBI) 


From: 

Sent: 

To: 


Subject: 


I ~~I OTP) (FBI) 

Thursday. May 04. 2006 10:45 AM . 


OTP H5P~ 


lfo6 

bfi 


□ (OTD) (FBI)E 
~l(OTD)(FBI)CI 


□(OTD) (FBI)C 


I l /6 TC >W r B I H 

' Chicago IPpIan 


JCG) (FBI):L 


~1(OTD) (FBI)i 


U 


jc<5) (tm 


3c>wm . 


NON-RECORD 


Hi all, 


There has been a slight change to the IP address plan for the Chicago move. We have temporarily allocated a new block 
of IPs to the old building and a new block to the new building. Here is the list of events that need to happen: 


Add new block of IPs to old building ! ' 

'■ s ' this has already been done with the main router set fcr! 


HZihRA) hl 

(use this as the gw) 
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— ULCHLTT j- 

2.a. Change the IPs for the portable VB at the old building to use the|_ 
b. Change the RW one way push boxes at the old building to use th< 


tA scheme. 
Tra scheme. 


1 q \ 3, Install new circuit to new building with ip ad dresses ofl 
1 3 1 router will be installed with ip address! 


J (use this as the gw) 


4. a VB at new building should be setup to use IPs foi l | RA scheme 

b. | l one way push boxes at new building should be setup for 8th RA scheme 

5. When Chicago is ready, move DCS-3000 machines and main FO IPs to the new building. No ip changes will need to be 

made to these machines. r „ 

6. a. Change VB IP s at new building to main FO IP scheme. . 

b. Change j j one way push IPs to main FO IP scheme. 5V 

*** note, the aE75ve step is optional, but recommended *** b " 

7. When service at old building no longer needed, shut down Circuit- 

Going with this plan will make the transition much more simple. The drawbacks are having to change the VB and llP 
addresses after the systems are up and running, or, if we skip step 6, then the waste of a block of IPs. I__l 

If anyone has any questions about this, please give me a call, 
thanks! 


pTD) (FBI) 

01, 2006 11:59 AM 


low is my response to the restoration/enhancement of funding. 



2) The TICTU requires ! j for the upgrade of DCS 3000 server machines. The DCS 3000 server machines are 
aging and require upgrade to 

provide reliable data storage. These machines are installed in every FBI field office and require 24/7 operational 
readiness for support of both Title III 

and Title 50 CALEA based Electronic Surveillance (ELSUR). The failure of these machines will result in the loss of 
collected data and intelligence. 


□ 
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From: I ~1 aT) (FBI) 

Sent: Mnndau Mavm ?nn fi 10:58 AM 

To: I I (OTD) (FBI) 

Subject: Failing UPS in Atlanta 


u N GbAse t F iee 

NON-RECORD 



Before I forget to address this (as it is of low priority), I spoke wit l l last week about an UPS which has failed 
twice since being installed with the "new" DCS-3000 rack/equipment. It was significant last week because it was the 
primary power source for two routers (DCSnet and other Atlanta DCS ro uter) and our secondary pix. I don't think the UPS 

had an F#, but \ have a serial number for you it is ! I The control panel on this unit has always (s ince 

removing it fronh its original packing) looked wrong - i.e., the buttons were excessively recessed. ! [ MIGHT 

remember this from the Atlanta install. Bottom line.. . if this is under warranty, we should look at having it fixed. If not, I 
think we need to surplus this one and consider a new one. 

At your convenience, please get in touch with me about this. 


b2 

foS 

lb7C 

b7E 



I 

From: 

Sent: 

To: 

Subject: 


JOTD) (FBI) 

I 1 (NK) (FBI) 

Monday, May 01, 2006 8:24 AM 
I "lOTDHFBQj 


He: UUS 3UUl|_ 


] (OTD) (FBI) 


lb 2 

fos 


fo7E 


NON-RECORD 


N I 

Sorry to bothe r vou all again. We are having problems with the DCS 3000 1 I For some reason we are 

not getting the ! I calls. They are coming in sporadically. When the ca se agen ts matches the DCS calls to the 
subpoenaed toll records she is missing a lot of calls. I think it might me s | I switch problem in the area where the 
phone is located, but I wanted to check with you guys first. 


sa | ~ 

Newark Division 

s7 i I 


fc6 

b7C 


UNCLASSIFIED 
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I In^Qsnpn) 

| JDCS3000) 

Below is the ETMU New Employee Orientation Agenda for the upcoming May orientation. Would you or a designated 
alternate be able to present the technology overview in your area of expertise? Please let me Know. 1 am trying to firm up 
the agenda. Our offices are moving to ERF E in the next couple days I mav nnt have access to trilogy for a couple days to 
a week. Please call me to confirm 54C | | h rough Friday, 70 ^ p arting Monday, May 1. I'll be on the 1st 


ELSUR Technology Management Unit (ETMU) 
Electronic Surveilla nce Techno logy Section, OTD 
Current Office: (540 ) | I _ 

New Number Effective irfay 1 (703\ | 




20062QAgendaVl. 
3.04262006.doc ... 


The May Orientation is quickly approaching. Attached is the latest agenda. This will be the first orienation held in the new 
ERFE building. A map and directions are forthcoming. We will have an LCD projector and screen in the conference room. 
You will need to bring your presentation on media (CD or memory stick). Please let me know if you have special 
equipment needs for your presentation. 

We have a full agenda and 10 new employees eager to hear your presentations. Below are suggested guidelines for your 
presentations: 

Provide an overview of services/purpose within the customer organization 
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Future initiatives 

For those outside of ETMU, discuss the relationship between ETMU and your area 

If you can make a portion of the presentation interactive that would be great 

Use success stories to depict the culture or the relationship between ETMU and your area 

Most presentations are 30 minutes. Allow 15-20 minutes to present with 10-15 minutes for interaction and Q&A 

Please bring the presentation on CD. We will provide all the presentations to attendees on one CD at the close of the 

orientation. The CD cannot be classified. Program Sensitive is fine. 


Note my new office number effective May 1 @ ERFE below. Please advise of any questions you have. I may not have 
easy access to trilogy for the next week during our office move. Please call me with anything you need. 


Thanks to everyone! 


ELSUR Technology Management Unit (ETMU) 
Electronic Surveilla nce Technol ogy Section, OTD 

Current Office: (S40 \ \ 

New Number Effective Mav 1 (703) \ I 


S E NS I T I VE - PUT UNO b AOQ i nCD 


]( 0TD ) (FBI) 


From: I loTD) (FBI) 

Sent: Monday, April 24, 2006 2:41 PM 

To: I | (OTD) (FBI)! 

Subject: FW: DCS 3000 Security Accreditation ' 


□ (OTD) (FBI) 


be 

b7C 


NON-RECORD 


NON-RECORD 


I ! • re my previous email re ! I Now he wants copies of the SSP and ATO for the DCS 3000. Please send me an 
electronic copy & I will provide it to him. 

Thanks 

be 

b 7 C 
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■ sccna - 


1=1 you still need assistance on thj 
put it on one of the DCS 3000 systems 1 


Tuesday. April 11. 2006 12:57 PM 


U f JGLA S G WEP- 

NON-RECORD 


— Original Message — 

From: I I HOI (FBI) 

Sent: Saturday. April 08, 2 006 6:45 PM 

To: I IfOTDI (F BI1 

Subject: I I list 


I (OTD) (FBI) 
6J.:26 PM 


> If you have a chance we would like to get the file you have. You could 
lownload back here to Quantico. 


C=] I needed a list to look up CID / LAC fc j 
recent list, maybe t han you folks have. J ust in case yo 
we haven’t had yet. I I 


for] | This may be a more 

u need it regarding the conversation 


P.S. I tried to e-mail the Excel Spread Sheet to you, but your mailbox is too full. Old ite ms, 
etc, or the file is just too big. It is around 10 MB. It's all theirf ] 





iiECRE^- 


(OTP) (FBI) 


From: b6 

Sent: bic 

To: 

Subject: 


I t WFi (FBI) 

Wednesday Aoril 19 2Qflfi 9:02 PM 

l (OTD) fFBn l 

| nformation/questions and a DCS 3000 question 


JOTD) (FBI) 


U N GLASG IHee- 
NON-RECORD 

dm 

Hey. How are t hings? 

I was taikinn tni llQday and she tol d me they were given a p en register request. It turns out the line was ported out 

t d I She talked to l lan d they to ld her the y could only give us the incoming 

calls. We were told the outgoing calls could be received frorr l | A call to | j r evealed that they do np t have a 

CALEA solution yet but they are currently working on it. They did tell us they could give u a ^ CDR). 

A couple of questions - 

Do you have any recommendations fori 

Do you know if/how other offices have handled this? 

I not iced vou d on't have a contact foil j on the TlCTii website and was not sure if you had one. This is the number 
that | p alled: 732 | | and spoke to | ] (the spelling might be off). I hope this might help you. 


h2 

fee 

fe7C 

fc7E 


DCS question - 


I looked through the manuals for the DCS 3000 and could not find anything f or the! | client. I am sure you have shown 
me in the past how to use it but I can't figure out how to put the number in th j I client. Can you give me som e 
instruction on this? You can email it to me or if you want you can call and leave me a message 2Q2 j | ~ 2 



[ 


From: 

Sent: 

To: 

Cc: 

Subject: 


l(OTD) (FBI) 

l wrin< ^„ A p 

| l — 

Rfc: H Line to( 


JOTD) (FBI) 
2906 2:3f PM 
J(IP) (FBI) 
ElLp) (FBI) 


fee 

■fe7c‘ 


NON-RECORD fee 

fc7C 

He v l I 

I talked with the guys here about funding the l "T circuit and we have concluded that we just don't have the budget 
for it this year. We have asked for a budget enhancement from HQ, so, if we get it, we may be able to fund it next year. 
The only way we know of to fund that circuit is going to be through case funds. I would figure that building the circuit to 
Chicago is going to be cheaper than building to Indy. 

When you are ready to build your circuit, please let us know so we can prepare the routers. 
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he status on this request? 



NON-RECORD 


]lP) (FBI) 


22, 2006 9:46 AM 
:FLSD) (FBI) 


b7C 

b7E 


'he Tech agents have installed a| |work r oom in both th^ 

We are in need to have installed a T-1 line 16 Efihg these! I recoraers on-line. This T-1 will connect 

between the Indianapolis field office location to our | f \ location. The question I have is, Is this 

something that your unit/section will pay for? If not, would you know the Unit back at Quantico that would 
handle th e payment for the installation and the monthly connection of this mandated circuit. Without this T-1 
circuit th<J IreenrHers can not brought on-line. 


TrA and the Field Office, 
me. This 


□ 


- — Original 

From: 

Sent: 

1 ° £ 


Mess^e-- 


Wednesday 

\ m (f 

FW: T1 Line ' 


I IP) (FBI) 

i, March 22, 2006 9:27 AM 


NON-RECORD 


Is there anyway to have this paid in the manner of the other phone bills which come out of HQ money, 


Mpss |ae— 


HlP) (FBI) 


— Original Mes 

From: 

Se nt: Mo nday. Ma rch 20, 2006 6:53 PM 

To l k lP) (F BI)! I (IP) (FBI);|_ 

SuDject: i i Line I 

UNGLAGOI Ftee- 

NON-RECORD 


3’ p ) ( pB C 


h2 

b7E 


Due to t he relocatio n of the Chicago Field Divisi on. Indianapo lis must establish a new T1 connecti on between 
Indy andl lo support the DCS3000 an d I T his connection is mandatory to allow l I 

to receive mituuii pe n register data from the DCS3 000 through Ind y's connection to Quantico. Without the 
connection you cannot effectively run a Title III in thf ffice. Below is a summary of the costs 

association with the connection. 


Ijg One Time Installation Fee (Indy to MERA) 

> D 7 C Monthly Service Charge 

Ultimately this monthly charge is not significantly higher than our previous connection to the Chicago Office. 
We are checking with the Engineering Research Facility (ERF) to see if they will pick up the cost. They 
already pay for our connection to Quantico and advised in the past all additional connections had to be paid by 
the Field Division. It cannot hurt to ask again. 

167 





_S£6Ref“" 


□ 


. Please let me know how you want this connection billed. 


I I S pedal Aoent be 

Te chnical Prog rams - Indianapolis Division b7c 
31 7 | [ (cell) 


i rririrn 


U N C U WS I F BP 


UNCLASS I F I ED 


~|(OTD) (FBI) 


From: 

Sent: 

To: 

Cc: 


I \ 0JD) (FBI) foe 

■Wednesday, Acril 19 .. 2006 12:53 pm b7c 


JOTD) (FBI) 
_30TD) (FBI) 


NON-RECORD 


Below is my best estimate of what they are asking for. We have a large number of DCS 
3000 computers 

that use Windows 2000 Pro or NT. This is denoted in the 
helps. b 


b2 

b7E 



□ 


olumn. Hope this 


Report of non-networked IT CPUs at OTD with MS software 


CPU Type 






[Computer 

lUsage 

Desktop 

2 

0 

| 3 

125 

0 

DCS 3000 

Laptop 

1 

0 

° 

30 

0 

DCS 3000 


•SECRET 



From: 

| 


l(LA) (FBI) 

Sent: 



Qgg 10:51 AM 

To: 



|(OTD) (FBI) 

Subject: 

ren i 

^gistsmr 

FTOUrSample 



Attached is an example of the pen register printout that we provide to the Case Agents ! I discribed what the 
prinout looks like from the DCS 3000 and it is not going to work for the Case Agents. 




3CCRE 1- 

RECORD 269-HQ-1 366780 


| | and/ot j 1 


| is setup and connected to the network. The line currently connected to port 1 of the card is 305- 
iclvise as to what further coordination is required between us (Miami), the CO and your end. 




■T 



ELSUR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Op erational Te chnology Division (OTD) 

305| [Desk) 

754 Cell) 

30 3 i Faxl 


JMM) (CON) 
[006 6:13 PM 
HpTD)(FBI) 


Requirement for Miam 


Since the DCS3000 Low Side Client for the one-way push was installed, do we still need the Miami I? 


DCS3000 Client MIAMI II 
DCS3.Q0.Qlow Side Client! 


ELSUR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Op erational Te chnology Division (OTD) 

[Desk) b6 

a IS! 


-sseRer 


' 



□ 

Just got off the phone with j | Yes, I am here on Saturday. Here is a write up for your records. 

Our Pen report sh ould zero records for a fe w| [l umbers. Checking the DCS 3000 Multiserv er Monitor, ther e 

j £ t red light next to th ^ fe witch. md LiMP Monitor indicated no response to lP addres; 

\ 3 } descriptor. By the way I could ping th 


' descriptor. By the way I could ping that address. 
^ resianL 


J e was a 
lue to b 


recommendation to stop and restart the the multiserver application and that seemed to fix the problem. After 
ig the Mutiserver Monitor, the light turned green and the error messages in the CMP Monitor went away. 


Give me a holler on Monday if you have any questions. 
Regards, 


Telecommunications Specialist SO-1 


212 

646j 

641 


I ' 1 i ' 


;ell) 

] (cell t< 


be 

b7C 


- on e LAC B inc p 


| |(OTD) (FBI) 


From: 

1 

](MM) (CON) 

Sent: 


2006 3:55 PM 

To: 

1 

"1 (MM) (FBI) 

Cc: 

1 

ftoTD) (FBI)J_ 


(UUN)I 

_3mM)(H 

Subject: 

RMS for Miami Ops 



NON-RECORD 


](MM) (FBI);[ 


b2 
be 
b7C 
b 7 E 


□ 


We nee d an RMS generated requesting an DCS-300C f | Serverto support a CALEA pen intercept frorr^ 
I pan give you case specifics. Thanks. 1 1 

TeERnology Management Unit (ETMU) 
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«T. 


8C6RET 


Electronic Surveillance Technology Section (ESTS) 
Op erational T echnology Division (OTD) 

305l l(Desk) to 2 

954] |(Cell) be 

305| |(Fax) fo?c 


From: 

Sent: 

To: 

Cc: 

Subject: 


(OTD) (FBI) 


fas 

JhTC 


a 


□(uiu) (FBI) 


H(OTD) (FBI) 

29, 2006 2:32 PM 
(GG)(FBI) 

*CG) (FBI)|_ 


RE: Chicago circuits to move or not move for DCS-3000 


](CG) (CON); | ~| 


NON-RECORD b6 b 2 

b 7 C fc> 7 E 

-a 

Yes, please order the replacement circuits. The I C ircuit is shared with the rest of the field, but I'm not sure who all is 
using the other one. Either way, though, we don’t currently have the budget to take over those circuits. 

thanks! 


— Original Message^ 


be 

b 7 C 




3 CG > ( FBI ) 


rTCreh29 . 2006 1:15 PM 
rOTDHFBII 

□CG) (FBI)(__ 


Subject: RE: Chicago circuits to move or not move for DCS-3000 


□(CG) (CON) 


NON-RECORD 


b2 

foe 

fo7C 
fo 7 E 


That sounds like a good plan| | Should we order new circuits fo| (ourselves? Are these 

inputs that you are distributing throughout the field or are these just for Chicago useV 1 

I I 

Sincerely ; 


Technically Trained Agen t, h 6 

Chicago Division b7c 



— Original Message-.-- 

From: | l(OTD) (FBI) 

Sent: Wednesday, March 29, 2006 10:08 AM 


172 


- s c cnin — 






(OTD) (FBI) 

dav March 23. 2006 11:3£L£M_ , 

' 0TD) ( FB| ): I 

I (OTP) (CON) 

Information Kequest - Needed by Friday 3/24 


The cost of the hardware, software, and the riffvpinpmpnt wnrk fnr thp interfar.p to the Trilogy network or other FBI IT 
infrastructure for the DCS-3000 system is approximately! | Th p majority of this cg st is for hardware (e.g 

routers and other networking equipment). The DCSne t jftSK aiWMffiatel yl | if you include the IP 

service contract we have witl] |can elaborate on this topic if needed. 


KOTO) (FBI) 

rhursday. March23. 2006 8:56 AM 

, fr oTm (FS1); | 
t OTD) (CON) 

-w: II Information Request - Needed by Friday 3/24 


Due to the move, please provide ! l /vith all submissions no later than 3pm today] |and i will gather 

the data to send it to the front office later this afternoon. 

a the DCS-6000 does not connect to trilogy, operate remotely over an IT system, or prepares data to be sent 

i IT system. But, how it relates to DCS-NET may be a different story. So as not to duplicate numbers, if there is 
an IT cost for the 6000 and DCS-NET, can you include that number (and notation) with your estimate? Thanks. 


t OTDI (CON) 

March 2 3. 2006 8:14 AM 
" t OTD) (FBI) 

ormanon Request - Needed by Friday 3/24 


| | We should try to complete this task today because tomorrow many of our Trilogy machines 

will be disconnected by 2 pm. Thanks. 


-seeftrr 




NON-RECORD 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed 
on the OCIO master list of systems, applications, databases, and networks. For the systems/projects listed 
below, please determine or estimate as best you can the cost of the hardware, software, and the development 
work for the interface to the Trilogy network or other FBI IT infrastructure. This will help us separate the 
funding of National Security Systems that are not truly IT from IT systems, databases, applications and 
networks. Please provide an estimate by Friday 3/24. 




JSEeRET 





•ftcREf 



Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 
Quantico. Virainia 

703 |— ~ | 


fc' 



Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed 
on the OCIO master list of systems, applications, databases, and networks. For the systems/projects listed 
below, please determine or estimate as best you can the cost of the hardware, software, and the development 
work for the interface to the Trilogy network or other FBI IT infrastructure. This will help us separate the 
funding of National Security Systems that are not truly IT from IT systems, databases, applications and 
networks. Please provide an estimate by Friday 3/24. 



Thanks, 


1 PE. PMP 

T prooram Management Office Manager 
ELSUR Management Technology Unit lb 2 

Electronic 
Phone: 70 
Cell: 

Fax: 




Iet 



necessary. Thanks. 




supervisory special Agent 

Telecommunications Intercept and Collection Technology Unit (T1CTU) 

Electronic Surveillance Technology Section 
Operational Technology Division 

Quanjjgg^jigjnia b 6 

7031 I b7C 


— Original Message — 

From: | 


5 


mr 


ID) (FBI) 

1)06 4:11 PM 
ZlOTD) (FBI)£ 
IfOTDl (FBlff 


fl (FBI); 
|OTD) 




IOTP ) (FBI)J“ 

Iona imJ 


HoTD)( FBI)r 


J(ITD) (FBI)4_ 


I OTP) 

□(OTD) (FBI); 


Information Request - Needed by Friday m 4 


NON-RECORD 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed on the 
OCIO master list of systems, applications, databases, and networks. For the systems/projects listed below, please 
determine or estimate as best you can the cost of the hardware, software, and the development work for the interface 
to the Trilogy network or other FBI IT infrastructure. This will help us separate the funding of National Security 
Systems that are not truly IT from IT systems, databases, applications and networks. Please provide an estimate by 
Friday 3/24. 


DCS 6000- IT Interface 
DCS 3000 - IT Interface 


b2 

b7E 


nrSKIPt rr.AI FA transmit 


Thanks, 


PE, PMP 

. Program Management Office Manager 
hLtjUK Management Technology Unit 
Electronic Surveillance Technology Section, OTD 
Phone: 7031. 




lb 2 
to 6 
b7C 


SE NS IT I VE BUT UMC L ASS I S IEP 

SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 


183 


^rcnri - 




■6ECREJ//N0F0RN 
RECORD 315 


Hey fellas, 

I'm not certain if it wa s I l or you fellas but thanks for fixing the VOIP collection for 7lft l I Can 

someone look at (917 1 I ? This number was instituted a few weeks ago but no pen data comes up. The audio 

looks OK. 

Also, SO-1 has been instructed to begin uploading FISA pen register reports from Counterterrorism targets into the 
Bureau’s Telephone Application database as standard practice. Unfortunately, the FISA pen records are separated by 
dashes as a delimiter. The pen reports on the criminal side, which have been uploading on a regular daily basis, use 
commas. Can you fellas change the interface at ERF to send the FISA pen data with commas instead? 

Looking forward to seeing you fellas again when you install the equipment for the DCS3000 push into | | 







From: 

Sent: 

To: 

Cc: 

Subject: 


I \(WF) (FBI) 



F QTD) (FBI) 
jWF) (FBI) 


UNCLASSIFIED 

NON-RECORD 

be 

fe7C 

Hi , 

1 I in addition to this problem, now if there is a first | 

call with no CDC message and it hangs up # then when a second 
call comes in with audio, while this call is going on, if the 
CDC for the first call comes in it either minimizes the current 
call or takes over the current call (giving us the white bar) 
causing the audio on the second call to be lost. Is it possible 
this audio is still on the sys tem and if so can it be retrieved. 
Can you please look into this. | { advised that they took 

the number out of their system and put it back in. We are 
having them check this again, for the problem is still not 
corrected. Can you please look into this again. I will forward 
you the another e-mail with these calls listed from the case 
agent . 

Thanks for your help. 


1 1 

— Original Messagg^ 

From: 1 

Sent: pEE 

kwn (fbi) 

i/ Marrk l/Onns 8; 30 PM 

fo6 . 
b7C 


cci i 

|(WF) (FBIT1 

IOTP) fFBnl 
KWF) (FBI)j 

|WF) (FBI) 

Subject: T~~ 

|pr6HI6ffl 

b2 

b7E 




NON-RECORD 


^ me roiiol 


ie following problem was reported to us 03/10/06 


There is a current Title III up on 4 telephone number. 

We are receiving the CCC fine. _ 

The CDC is not being received at the time of the CCC at the ! l and DCS3000. 

It has been witnessed of taking more than 5 minutes to receive the CDC. 


If the call is long then the CDC attaches itself to the CCC and their appears to be no problems. 


185 



Secret — 


Vp gl hiri install ci rcuit We will be moving in circa 4/15. We were initial ly set to move in during this week and next, 
bu ] fc annot have our new stuff installed 'til 4/10. I talked to | F ast week and I will be 

submitting an RMS today for two new DCS-3000s, etc. In answer to your question I will need new routers. The old 
equipment was toss about during the move from NO to storage in Baton Rouge and I have no fait h in their usa bility. ! 
would say ship those to our old office in NO on or about 4/15. Any questions, give me a call (504 ] | 

Thanks for your helpl I 


J New Orleans 
office (Temporary) 


Subject: New Orleans DCSNET circuit 


1 I tells me your DCSNET circuit in New Orleans has been installed and is ready for turn-up. Do you have an 
updated schedule on when you will be moving in? Will you need new routers? Any idea what happened to the old 
equipment that was there? 

Your ckt td-i j I bi 

l| ^ J Please let me know if you have any questions about this circuit or the install. 
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I |[ N0) (FBI) 

Monday. March 06. 2006 11:15 AM 
1 J OTD) (FBI)I- 

I ITOTPI (FBI)L 

RE: New Orleans DCSNET circuit 


Ye d I d id install circuit. We will be moving in circa 4/15. We were initial ly set to move in during this week and next, 

but Systems Furniture cannot have our new stuff installed ’til 4/10. I talked tc | | last week and I will be 

submitting an RMS today for two new DCS-3000s, etc. In answer to your question I will need new routers. The old 
equipment was toss about during the move from NO to storage in Baton Rouge and I have no fai th in their usa bility. I 
would say ship those to our old office in NO on or about 4/15. Any questions, give me a call (504 1 I 


Thanks for your help|_ 


aor, New Orleans 
| Office (Temporary) 
J Cell 


— Original Iteyjafj-—- . 

From: I I fOTDt (FBI) 

Sent: Monday, March 06, 2 006 9:50 AM 

To: I fNO) (FBI) 

Cc: I r OTDt (FBI) 

Subject: New Orleans DCSNET circuit 


| p ells me your DCSNET circuit in New Orleans has been installed and is ready for turn-up. Do you have an 
updated schedule on when you will be moving in? Will you need new routers? Any idea what happened to the old 
equipment that was there? 

Your rkt id , r I hi 

( 2 ) p,ease ,et me know y° u have an y questions about this circuit or the install. 


SE - CR E-F — 



From: 

Sent: 

To: 

Subject: 


FW: Power outage and the DCS 300 


NON-RECORD 


— Original Messa ge — 

From: I I/ vr (FBI) 

Sent: Tiiocdau Fphman/ ?« 2006 7:00 PM 

To: I J/rvT-m (FBI) 

Cc: I J( WF) (FBI) 

Subject: Power outage and the DCS 300 


b 6 
b7C 


UNGLAGG t RE -D 

NON-RECORD 


CZI 

Sorry I didn't inform you earlier. 

There are 2 planned days of power outages for the 3rd floor at WFO which will affect the DCS 3000. 
They are March 1 , and 2. It will start about 6pm and go until possibly 6am. 


UNCLASSIFIED 


191 


OTD)(CON) 
,200611:27 AM 
OTD) (FBI) 


From: 

Sent: 

To: 

Subject: 



Visit Request 


| | is the Booz All en emplo yee working on refreshing the DCS'3000 Security Plan. She has requested a data 

TjarnsnnTjTnssnng with you an d I 

Please send a visit request on her behalf once you have established a meeting date. 


let me know if you have any questions. My ERF extension is 



b2 

b7E 



Yes, please have them sent here if possible. We are ordering the V.35 serial card that will better suit our network 
configuration and hopefully they will be here by the time the channel bank gets here to test. We can test and turn 
them around in a couple of days if all goes as expected. 



192 


jseefigT 





He y | I 

I've left a message fo l l at f h o talk with him about the channel bank. On their website they 

show a card with a V.35or RS-232 interface that would probably better suit our network. Hopefullv T I 
will call me back soon and we can discuss pricing. Depending on the cost, TICTU may be able to get the 
cards. Do you know if there are open slots for another card in the Seattle-Spokane channel banks? 

We would still like to test the system in the lab with the current configuration in case the serial cards are 

cost prohibitive. The address here at ERF is Building 27958-A, Quantico, VA 22135. 

thanks! 




[=□ , , 

We have tracked down the purchase request of the channel banks for the j | 

link. The delivery of these to the Sacramento field office is on hold. I understand that you would nice 
for them to be delivered to you at ERF for testing of DCS-3000 traffic utilizing these CB's. If that is the 
case please reply with the address to where you would need them sent. (That is, of course, unless 
someone else says to not do this.) 

After sp eaking with some of our folks about the transfer of the DCS-3000 d ata via the T-1 links (fo r 
both the | tes), I am moderately confident that the | t/vith 

the CB's" will support tne need to send your system’s data between the sites it anotner card is 
required to support this effort we will need the model and (as always) someone will have to fund it. 


ELS UR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Operational Terhnnlnev Division (OTD) 

54C 'Desk) 

540 'Fax) 

540 'Mobile) 
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SEefilET 


V 



be 


hlC 


hi 

lb 7 E 


— Original M< 

From: 

Sent: 




IIKI^. flOCICIFn 

NON-RECORD 


Irro) (con) 

16, 2006 2:33 PM 
l(OTD) (ESI) 


WD) (FBLC 
TO) • ON)l 


^ ^ rrm (CON)^ 


r sa (fbi);. 

I (OTP) (CON] 

_pC)(CON) 




We have tracked down the purchase request of the channel banks for the ! I link. 

The delivery of these to the Sacramento field office is on' hold. I understand that you would like for them to 
be delivered to you at ERF for testing of DCS-3000 traffic utilizing these CB‘s. If that is the case please 
reply with the address to where you would need them sent. (That is, of course, unless someone else says 
to not do this.) 


Aft er soeakina with some of ou r folks about the transfer of the DCS-30 QQ data via the T-1 lin ks (for both 
th d l ites). I am moderately confident that the l ~l with the CB's, 

will support the need to send your system's data between the sites. If another card is required to support 
this effort we will need the model and (as always) someone will have to fund it. 


Thanks. 


ELS UR Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
OperaliooaLjEechnology Division (OTD) 


54 or 

540] 

540\_ 


'Desk) 

'Fax) 

'Mobile) 


be 

bvc 




urtrLAQOiriEn 

-PW Cl.Mfi l F I FP - 


197 


■SEfflEfl 




‘MS- 


•b7E 


H *i l I 


I've left a message fo l l a d t o talk with him about the channel bank. On their jMebstte they show a 

card with a V.35 or RS-2^2 interface that would probably better suit our network. Hopeful ^ |v iH call me back 
soon and we can discuss pricing. Depen ding on the cost. TIC TU may be able to get the cards, uo you know if 
there are open slots for another card in th d fc hannel banks? 

We would still like to test the system in the lab with the current configuration in case the serial cards are cost 




delivery of these to the Sacramento field office is on hold. I understand that you would tike for them to be 
delivered to you at ERF for testing of DCS-3000 traffic utilizing these CB's. If that is the case please reply with 
the address to where you would need them sent. (That is, of course, unless someone else says to not do 
this.) 

After speaking with some o f our folks about the transfer of the DC&aQQQ *=>»=> wig tho t i links (for both the 
I fc itesl l am moderately confident that thq lwith the CB's, will 

support the need to send your system's data between the sites. If anotner card is required to support this 
effort we will need the model and (as always) someone will have to fund it. 


tLSUk Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
OpefatiooaLZechnology Division (OTD) 

540 'Desk) 

54C 'Fax) 

54C 'Mobile) 


fo6 

fe7C 




NON-RECORD 


He Q , 

I've left a message for i e t | l to talk with him about the channel bank. On their w ebsite they show a card 

with a V.35 or RS-232 interface that would probably better suit our network. Hopefully ! t will call me back soon and 
we can discuss pricing. D epending on the cos t TICTU may be able to get the cards. Do you know if there are open 
slots for another card in th ^ C hannel banks? 

We would still like to test the SySlSM irt M6 ISP with the current configuration in case the serial cards are cost 
prohibitive. The address here at ERF is Building 27958-A, Quantico, VA 22135. 


JITD) (CON) 

S 6, 2006 2.33 PM 
;OTD) (FBI) 

D) (rei);l 


We have tracked down the purchase request of the channel banks for tht link. The 

delivery of these to the Sacramento field office is on hold. I understand that you would like for them to be 
delivered to you at ERF for testing of DCS-3000 traffic utilizing these CB's. If that is the case please reply with the 
address to where you would need them sent. (That is, of course, unless someone else says to not do this.) 


■ flftnrnnnn i . i na t n i i Ja . apme of our folks about the transfer of the DCS-3CI00 data via t he T-1 links (for both th j I 
I I sites), 1 am moderately confident that the l w vith the CB's, will support the 

need to send your system's data between the sites. If another card is required to support this effort we will need 
the model and (as always) someone will have to fund it. 


ELS UK Technology Management Unit (ETMU) 
Electronic Surveillance Technology Section (ESTS) 
Op erational Te chnnlnerv Division (OTD) 

54C 'Desk) 

54C 'Fax) 

54 C Mobile) 
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To: 

Cc: 

Subject: 






~|oTm <FB0 > 

From: 

I |(OTD) (FBI) 

Sent: 

Fridav. February 17. 2006 1:04 PM 


lOTDXFBil. 
□OTD) (FBI)[_ 


1 T °) (I 


NON-RECORD 


□ 


We have identified a problem significant problem with tt 
CallingPartyldentity for incoming calls. 


Background: 


ib2 

fo7E 


^switch: misrepresentation/misinterpretation of 


The Phoenix division is currently active on l I PCS Title III intercepts (Target A and Target B). Recently, Target A 
called Target B and the monitor and case agent noted the calling party id presented in the Target B Termination Attempt 

a e was not Target A's directory nu mber. A fter interviewing the subscriber of the intercepted calling party id (another 
CS customer) and determining no l I between this subscriber and Tarnet A or B, the Phoenix division . , 

!d me yesterday to report the problem and ask for an explanation. ! l and I examined the | | ;|1 °‘ 

messaging for the specific call and initially had no plausible explanation. ‘ 


Analysis: 

Last night, I decided to examine the ensemble of interce pted messages for alj 
month of February. I compared the calling party id in the ! 
intercepted incom ing call. I found that nearly 12% of all incom 
| I targets ha d differe nt calling party ids in theL 


t argets for the 
^messages for each 


"for incoming calls" served b \l Switches and n ot I 
assume the calling party id in the j ine; 


irgets and 4% of all incoming calls to 

This phenomenon only occurred 
rom the analysis of the PX call data, we 


£ ot by an ^ t witches. 

nessaoe is correct when it is available (if th e calling party blocks their 

caller id the number is not available in tn a fr nessage). The results suggest the l I switch is incorrectly 


populating the calling party id field in the 1 ermi nation Attempt. I sampled and analyzed several of the bad messages and ^ 
have noticed the problem only occurs when the | fc f the incoming callin g party is presented in the Termination Attempt. 10 
My guess is the problem is due to the practice nr nnmh sr pooling where th l l and directory number (DN) a ssigne d to a 
mobile subscriber do not match. It a ppears th d fc witch is only populating the calling party id field with th j | when 
the calling party is anothe i I subscriber. This is a problem that cannot be remedied on our collection equipme nt 

(DCS-3000, DCS-6000, and DCS-5000) because the calling party DN is not always available in the l I 

message (e.g., blocked caller id); thus, we have to rely on the caller id in the Termination Attempt message. More 
importantly, it's a problem for all of law enforcement who may be executing their cases using bad trap/trace information. 

I recommend OTD notify all divisions about the problem, and I suggest we seek immediate 
available any time to further discuss this problem. ^ _ 

| | !b6 

1 1 b7C 

ib7F; 


fro m | 1 I a 
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From: 

Sent: 

To: 

Cc: 


Subject: 


W CLAGC i r iEP 

NON-RECORD 


Hey | I 

I’ve left a message fo l ) at [ l to talk with him about the channel bank. On th eir website, they show a card with 

a V.35 or RS-232 interface that would probably better suit our network. Hopeful! ^ [ will call me back soon and we can 
discuss pricing. D epending on the co st. TICTU may be able to get the cards. Do you Know if there are open slots for 
another card in th e| C hannel banks? 

We would still like fc 16*51 triti sySTSTTrin the lab with the current configuration in case the serial cards are cost prohibitive. 
The address here at ERF is Building 27958-A, Quantico, VA 22135. h 





of these to the Sacramento field office is on hold. I understand that you would like for them to be delivered to you at 
ERF for testing of DCS-3000 traffic utilizing these CB's. If that is the case please reply with the address to where you 
would need them sent. (That is, of course, unless someone else says to not do this.) 

, After sneaking witf i some of our folks about the transfer of the DCS-3000 data via the T-1 links (for both th| ' J 

| | tes), I am moderately confident that th j l with the CB's, will support the need t6 

send your system's data between the sites. If another card is required to support this effort we will need the model and 
(as always) someone will have to fund it. 


Thanks. 


" hnology Management Unit (BTMU) 


Electronic Surveillance Technology Section (ESTS) 
Op&zliaaaLLechnology Division (OTD) 

54C | \ Desk) 



203 






At the request of our BAE guys, I returned to you a DCS 3000 server. I forgot to put the 734 in the box, so you will receive 
it in a separate envelope. Call with any questions. 



NON-RECORD 


n 

TICTU will need two tables for the upcoming Expo. Our platform displays the DCS-6000 Title III system and the SBIT 
DCS-3000 system. This is not considered extra, we had two tables last year. 


Thanks, 



— Original Message — 

From: CLIFFORD, MICHAEL (OTD) (FBI) 


Sent: 

To: 
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From: I 1/10) (FBI) 

Sent: I uesdav. t-eEruarv 14. 2006 2:58 PM 

To: I *~~^*~l (OTD) (FBI) 

Subject: Mobile's DCS 3000 



Like you said J I verified he h ad tro uble booting the old system up and that he just kept at it until it 
worked. He also mentioned that ) | helped him set up a duplicate system during that last mission. 

So, my next question would be....can you determine if the information that needs transferred to the 
new system is currently in the duplicate system listed below: 

Ib2 
b 7 E 

fol 

If so, we will use it to get the information needed to get the new one up and running. Let me know 
what you find out and we'll go from there. 






207 


From: 

Sent: 

To: 

Cc: 

Subject: 


' Kb: L)CS 3UUU Client station al 


g n, 2006 10/in AM 

mm f(jBi);L 


~lf9TP) (FBI 


JWF) (FBI) 


NON-RECORD 


Oka^ j ~~\ 

Tag - you are it. Get back with me so we can set up to do this. Call my cell - 202[ 

We will be doing some training on the use of this system on March 17th (9am-11:30), so let's get this up and running 
ASAP so we know it's working right and can be familiar with it by then. Who should I talk to about training material for the 
dcs3000? If you guys have references made up for it already (as I am sure you do), I would like to get copies (preferable 
digital copies). 

Thanks 

I b6 

gmigrtl fo'7C 


SA[ 

d 


be 

b7C 


— Original 

From: 

Sent: 

To: 

Cc: 

Subject: 


NON-RECORD 

□ 

1 l(703 i l is the in dividua l who called from TICTU regarding the equipment necessary for 

setting up our client station. Please give| |a call. 


">F)( 
T32PM 

'F) (FBI) 

- JTD) (FBI) 

DCS 3000 Client Station at Proshop 


be 

b7C 


Thanks,! 


be 

b'-'C 


UNGLA6S I R EB - 


■defter 



From: 

— 1 

L (OTD) (FBI) 

fo 7 C 



fl~2gQ6 6:39 PM 


To: 

Cc: 


— ■ tSA) (FBI) 


1 

J(OTD) (FBI) 


Subject: 

RE: DCS3000 




NON-RECORD 


We'll get you a router. 

tZZ] 


— Original Message — 

From: | 

Sent: , IuSMSy. Ml 

To: I 

Subject: 1 kb: PCS 3 UW ' 


5A) (FBI) 

» 5:32 PM 
)TD) (FBI) 


b6 

b7C 


NON-RECORD 


Did a loop back on the house wirin g and thd fa larm light went out. Made a reverse CATS (reversed 12 & 78) to 
test the router directly hooked to tht j | and the alarm light stayed on. So, it looks like the router is bad. What 
next? 


H(OTD) (FBI) 
JQ06 2:25 PM 
JSA) (FBI) 


be 

fo7C 


UNOLADC i r i BP bl 

NON-RECORD 


(SI That explains it. You'll have to 
the change - just call me at 70f 


□ 


be 

b?C 


— Original Mess 

From: 

Sent. 


address on the machine tol 


I (SA) (FBI) 
Y 31, 2006 3:14 PM 


] I can walk you through 


NON-RECORD 


The machine is in SAHQ in the office. 


Original Messs 

From: 


[OTD) (FBI) 

‘ 209 




210 


-SECRET 



| | 

Hello - I have spoken to you a few times on the phone mainly about the pen register we had up in| |I have b' 7 

recently assu med the duties of Houston's other TS for the covert side and the topic of training was brought up. 

I Isuqaested I contact you about possibly attending a training class for the OCS 3000. He mentioned 

tha- | | is working on a computer based training but did not know when that would be available. Is 

there plans in the future for a training class? If so, I was advised that I should attend. 


Please advise at your convenience. 







- — Original Mes 

From: 

Sent: 

To: 

Subject: 


NON-RECORD 


e with some of the guys who were using the DCS3000 during the case and got their input. 

This case involved a drug related kiddnapping which to ok place irl 1 The victim was 

later transp orted to Charlotte . NC. Initially we went up on a | b ell phone which belonged to a U C Police Office r 

posing as a | | and whom received ransom demands. Over the next few days we obtainec j t ell 

phone numbers heinnninn In various Subjects from the group. We went up on Pen Registers on those as well. Initially we 





fc6 

E) (FBI) b7C 
Tupsrlav lannarv 74 2006 4:50 PM 
I f OTDI (FBI) 

RE: DCS 3000 issues 




Freedom of Information 

and 

Privacy Acts 


SUBJECT: DCS 3000 
FOLDER: DIVISION DOCUMENTS 
SECTION #39 



Federal Bureau of Investigation 




]ln impl ejnenti: 


nfthr trnditinnnll 



local loon, FIS As, the interface for cnllcctinp such infnimalion 

=1 1 


■ For details regarding traditional equipment and DNR systems, etc., go to the TICTU 
Website and consult the Traditional Technologies Intercept Team at 


> MANUALS: For traditional FISA intercept eq uipment Manuals see: 

] b2 

hlB 

■ For details regarding the DCS-5000, go to the TICTU Website and consult the 


> MANUALS: For major FISA collection platform Manuals see: 

I 


I 


■ For details regarding thd I go to the TICTU Website and co nsult 


Switch-toned; In.imnlflmniting switrh-ha.sori FISA F, LSI JR, TTAs frequently utilize the ! I 
I The DCS 3000 system may also be used. 

In other conventional (non-C ALEA) switch-based Title III, the interface for co llecting such 
information may be one of the | 1 


■ For details regarding the DCS- 3000 system, go to the TICTU Website and c onsult the 
Switch-Based Intercept Team a j | 

• For details regarding the DCS-5000 syste m, go to the TICTU Website and consult the 
> MANUALS: For major Pen Register/Trap-Trace collection platform Manuals see: 


For details regarding more conventional (non-CALEA) DNR equipment and DNR 
platforms, etc., so to the TICTU Website and consult the Traditional Technologies Intercept 
Team a j | 

> MANUALS: For traditional DNR equipment Manuals see: 
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The procedures for FBI technical personnel who testify as subject matter experts within the FBI’s 
TIP are the same as those that apply to other FBI witnesses, including adherence to the dictates of 
28 C.F.R.§ 16.21 et seq. Any legal or procedural questions should be promptly brought to the 
attention of the appropriate Assistant United States Attorney (AUSA) and the appropriate field 
office CDC or to an attorney in the Technology Law Unit, Office of the General Counsel, FBIHQ. 

m) Evidence Acauisition/Recordation/Handline: 

As noted, above, in the past, there was little prospect of FISA ELSUR information ever being used 
in court or other public venues. However, based upon recent rulings of the Foreign Intelligence 
Surveillance Court (FISC) and new interpretations of the FISA law and its purposes by the 
Department of Justice, it is now conceivable that FISA-based ELSUR information could be used as 
“evidence” in criminal cases or otherwise made public. 

■ Evidence Acquisition: FISA ELSUR equipment, techniques, systems, and platforms acquire/ 
intercept communications “content.” FISA equipment used in local loop interceptions typically 
captures analog audio tones/signaling that is captured as “content.” Under CALEA, which is carrier b 2 
a nd principally switch-ba sed, telephony content is referred to as call content and is transmitted over hi e 

a | t CCC).” Details as to the element s/format of CA LEA-comnliant call 

content in wireline and wireless networks are set forth in the j | The interface for 

collecting FISA call content may b e platforms such as the CALEA-related DCS-3000 platform 
and/or the DCS-5000 1 Ip latform. 

• Evidence Recordation: Once ELSUR information is acquired, the signaling information should be 
recorded electronically as the “original evidence.” Electronic recordation can be accomplished 
through recorders attached to the above-mentioned platforms. 

• Evidence Handling: 

If TTAs handle FISA ELSUR material, they run the risk of becoming part of the “chain of custody” 
for the ELSUR evidence, thus exposing themselves to the possibility of having to testify (contrary 
to FBI policy). Hence, TTA involvement in evidence handling must be avoided. 

For information regarding evidentiary matters arising from intercepting “oral” communications 
pursuant to FISA, see “Consensual Monitoring. ” below. 
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